diff --git a/assets/images/help/security/security-advisory-affected-product.png b/assets/images/help/security/security-advisory-affected-product.png new file mode 100644 index 0000000000..a640b49868 Binary files /dev/null and b/assets/images/help/security/security-advisory-affected-product.png differ diff --git a/assets/images/help/security/security-advisory-create-security-advisory-button.png b/assets/images/help/security/security-advisory-create-security-advisory-button.png index 6209fe5075..58259b631b 100644 Binary files a/assets/images/help/security/security-advisory-create-security-advisory-button.png and b/assets/images/help/security/security-advisory-create-security-advisory-button.png differ diff --git a/assets/images/help/security/security-advisory-description.png b/assets/images/help/security/security-advisory-description.png index a61de64669..52d730b190 100644 Binary files a/assets/images/help/security/security-advisory-description.png and b/assets/images/help/security/security-advisory-description.png differ diff --git a/assets/images/help/security/security-advisory-metadata.png b/assets/images/help/security/security-advisory-metadata.png deleted file mode 100644 index 61fdc610eb..0000000000 Binary files a/assets/images/help/security/security-advisory-metadata.png and /dev/null differ diff --git a/assets/images/help/security/security-advisory-severity.png b/assets/images/help/security/security-advisory-severity.png new file mode 100644 index 0000000000..20b7f3523e Binary files /dev/null and b/assets/images/help/security/security-advisory-severity.png differ diff --git a/assets/images/help/security/security-advisory-title.png b/assets/images/help/security/security-advisory-title.png deleted file mode 100644 index b2405a2c33..0000000000 Binary files a/assets/images/help/security/security-advisory-title.png and /dev/null differ diff --git a/content/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database.md b/content/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database.md index 3594a9f3ac..8142391c19 100644 --- a/content/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database.md +++ b/content/github/managing-security-vulnerabilities/browsing-security-vulnerabilities-in-the-github-advisory-database.md @@ -18,13 +18,13 @@ The {% data variables.product.prodname_advisory_database %} contains a curated l Each security advisory contains information about the vulnerability, including the description, severity, affected package, package ecosystem, affected versions and patched versions, impact, and optional information such as references, workarounds, and credits. In addition, advisories from the National Vulnerability Database list contain a link to the CVE record, where you can read more details about the vulnerability, its CVSS scores, and its qualitative severity level. For more information, see the "[National Vulnerability Database](https://nvd.nist.gov/)" from the National Institute of Standards and Technology. -The severity level is one of four possible levels defined in the [Common Vulnerability Scoring System (CVSS), Section 2.1.2](https://www.first.org/cvss/specification-document): +The severity level is one of four possible levels defined in the "[Common Vulnerability Scoring System (CVSS), Section 5](https://www.first.org/cvss/specification-document)." - Low -- Moderate +- Medium/Moderate - High - Critical -The {% data variables.product.prodname_advisory_database %} uses CVSS version 3.0 standards and the CVSS levels described above. +Some advisories have a specific CVSS score, which is assigned according to the "[Common Vulnerability Scoring System Calculator](https://www.first.org/cvss/calculator)." The {% data variables.product.prodname_advisory_database %} uses CVSS version 3.1 standards. {% data reusables.repositories.github-security-lab %} diff --git a/content/github/managing-security-vulnerabilities/creating-a-security-advisory.md b/content/github/managing-security-vulnerabilities/creating-a-security-advisory.md index f1c2117d3d..fd713c6afb 100644 --- a/content/github/managing-security-vulnerabilities/creating-a-security-advisory.md +++ b/content/github/managing-security-vulnerabilities/creating-a-security-advisory.md @@ -20,10 +20,11 @@ Anyone with admin permissions to a repository can create a security advisory. 4. Click **New draft security advisory**. ![Open draft advisory button](/assets/images/help/security/security-advisory-new-draft-security-advisory-button.png) 5. Type a title for your security advisory. - ![Title field](/assets/images/help/security/security-advisory-title.png) {% data reusables.repositories.security-advisory-edit-details %} +{% data reusables.repositories.security-advisory-edit-severity %} +{% data reusables.repositories.security-advisory-edit-cwe-cve %} {% data reusables.repositories.security-advisory-edit-description %} -8. Click **Create security advisory**. +11. Click **Create draft security advisory**. ![Create security advisory button](/assets/images/help/security/security-advisory-create-security-advisory-button.png) ### Next steps diff --git a/content/github/managing-security-vulnerabilities/editing-a-security-advisory.md b/content/github/managing-security-vulnerabilities/editing-a-security-advisory.md index 236473c986..d2914ae576 100644 --- a/content/github/managing-security-vulnerabilities/editing-a-security-advisory.md +++ b/content/github/managing-security-vulnerabilities/editing-a-security-advisory.md @@ -22,12 +22,14 @@ If someone accepts credit, the person's username appears in the "Credits" sectio 5. In the upper-right corner of the details for the security advisory, click {% octicon "pencil" aria-label="The edit icon" %}. ![Edit button for a security advisory](/assets/images/help/security/security-advisory-edit-button.png) {% data reusables.repositories.security-advisory-edit-details %} +{% data reusables.repositories.security-advisory-edit-severity %} +{% data reusables.repositories.security-advisory-edit-cwe-cve %} {% data reusables.repositories.security-advisory-edit-description %} -8. Optionally, edit the "Credits" for the security advisory. +11. Optionally, edit the "Credits" for the security advisory. ![Credits for a security advisory](/assets/images/help/security/security-advisory-credits.png) -9. Click **Update security advisory**. +12. Click **Update security advisory**. ![Add button](/assets/images/help/security/update-advisory-button.png) -10. The people listed in the "Credits" section will receive an email or web notification inviting them to accept credit. If a person accepts, their username will be publicly visible once the security advisory is published. +13. The people listed in the "Credits" section will receive an email or web notification inviting them to accept credit. If a person accepts, their username will be publicly visible once the security advisory is published. ### Further reading diff --git a/data/reusables/repositories/security-advisory-edit-cwe-cve.md b/data/reusables/repositories/security-advisory-edit-cwe-cve.md new file mode 100644 index 0000000000..1549f0a30d --- /dev/null +++ b/data/reusables/repositories/security-advisory-edit-cwe-cve.md @@ -0,0 +1,2 @@ +1. Add common weakness enumerators (CWEs) for the kinds of security weaknesses that this security advisory addresses. For a full list of CWEs, see the "[Common Weakness Enumeration](https://cwe.mitre.org/index.html)" from MITRE. +1. If you have an existing CVE identifier, select "I have an existing CVE identifier" and type the CVE identifier in the text box. Otherwise, you can request a CVE from {% data variables.product.prodname_dotcom %} later. diff --git a/data/reusables/repositories/security-advisory-edit-details.md b/data/reusables/repositories/security-advisory-edit-details.md index b2f5977718..c588c355d2 100644 --- a/data/reusables/repositories/security-advisory-edit-details.md +++ b/data/reusables/repositories/security-advisory-edit-details.md @@ -1,2 +1,2 @@ -1. Type the details about the security vulnerability that the security advisory addresses. - ![Security advisory metadata](/assets/images/help/security/security-advisory-metadata.png) +1. Edit the product and versions affected by the security vulnerability that this security advisory addresses. + ![Security advisory metadata](/assets/images/help/security/security-advisory-affected-product.png) diff --git a/data/reusables/repositories/security-advisory-edit-severity.md b/data/reusables/repositories/security-advisory-edit-severity.md new file mode 100644 index 0000000000..72672fa76c --- /dev/null +++ b/data/reusables/repositories/security-advisory-edit-severity.md @@ -0,0 +1,2 @@ +1. Select the severity of the security vulnerability. To assign a CVSS score, select "Assess severity using CVSS" and click the appropriate values in the calculator. {% data variables.product.product_name %} calculates the score according to the "[Common Vulnerability Scoring System Calculator](https://www.first.org/cvss/calculator)." + ![Drop-down menu to select the severity](/assets/images/help/security/security-advisory-severity.png)