Update of security.md by matthiaskunkel · Pull Request #11968 · ILIAS-eLearning/ILIAS

matthiaskunkel · 2026-08-20T12:40:16Z

Updated document about ILIAS security policy, incl. process changes due to CRA requirements

Added sections for responsibilities within the process, extended description on reporting issues and resposibilities of Security Group, esp in relation to ENISA, and more details.

Next step would be to move file to top level for better perception.

Updated content incl. process changes due to CRA requirements

marvimarv

Thank you for updating the security policy to reflect the CRA requirements! In my opinion the new "Responsibilities" and "Addressing a Security Issue" sections map the Art. 14 CRA obligations correctly (24h early warning, 72h initial assessment, final report 14 days after the fix release resp. one month after the incident notification), and the framing of the association as an open source software steward with BSI as CSIRT is well put.

A few things should be fixed before merging, though. Most importantly the table of contents, which is now largely broken: GitHub derives anchors from the heading text, so the shortened anchors (#about, #reporting, #fixing, …) point nowhere. I've left inline suggestions for everything.

Two general notes:

The diff introduces typographic quotes (‘…’) and apostrophes (’) in several places, probably from a word processor. Especially in the patch-filename examples these are risky because people copy them. Please use straight ASCII quotes throughout (inline suggestions below cover the critical spots; "association's", "CRA's" and "ENISA's" also carry curly apostrophes).
Regarding the announced next step of moving the file to the top level: full support. Note that GitHub only recognizes a security policy under the exact filename SECURITY.md in the repository root, docs/, or .github/. The current docs/development/security.md is not picked up. Once recognized, GitHub links the policy under the repository's Security tab and shows a hint to it when users open a new issue, which is exactly what "Never file a security issue in the bugtracker" needs. (Independently of that, enabling private vulnerability reporting in the repository settings might be worth considering; that adds a "Report a vulnerability" button on the Advisories page for confidential reports directly on GitHub.)

marvimarv · 2026-08-20T13:11:22Z

+* [About this Document](#about)
+* [Responsibilities](#responsibilities)
+* [Reporting a Security Issue](#reporting)
+* [Addressing a Security Issue](#addressing)
+* [Process for Fixing Security Issues](#fixing)
 * [Security Update Notifications](#security-update-notifications)
+* [Security Goals](#goals)
+* [Security Measures](#measures)
 * [Contributors](#contributors)


The shortened anchors don't resolve on GitHub — anchors are auto-generated from the heading text. Only #responsibilities, #security-update-notifications and #contributors happen to work.

Suggested change

* [About this Document](#about)

* [Responsibilities](#responsibilities)

* [Reporting a Security Issue](#reporting)

* [Addressing a Security Issue](#addressing)

* [Process for Fixing Security Issues](#fixing)

* [Security Update Notifications](#security-update-notifications)

* [Security Goals](#goals)

* [Security Measures](#measures)

* [Contributors](#contributors)

* [About this Document](#about-this-document)

* [Responsibilities](#responsibilities)

* [Reporting a Security Issue](#reporting-a-security-issue)

* [Addressing a Security Issue](#addressing-a-security-issue)

* [Process for Fixing Security Issues](#process-for-fixing-security-issues)

* [Security Update Notifications](#security-update-notifications)

* [Security Goals](#security-goals)

* [Security Measures](#security-measures)

* [Contributors](#contributors)

marvimarv · 2026-08-20T13:11:22Z

+team, the ILIAS Security Group.
+
+This document is not a guideline on how to set up and operate an ILIAS installation 
+securely. Such instructions can be found in the document /docs/configuration/secure.md


Could be a relative link so it's clickable:

Suggested change

securely. Such instructions can be found in the document /docs/configuration/secure.md

securely. Such instructions can be found in [docs/configuration/secure.md](../configuration/secure.md).

marvimarv · 2026-08-20T13:11:22Z

+The ILIAS Release Manager is responsible for packing and publishing security bugfix releases
+in accordance with the Security Group. Once a security release has been published, the


Suggested change

The ILIAS Release Manager is responsible for packing and publishing security bugfix releases

in accordance with the Security Group. Once a security release has been published, the

The ILIAS Release Manager is responsible for packaging and publishing security bugfix releases

in coordination with the Security Group. Once a security release has been published, the

marvimarv · 2026-08-20T13:11:22Z

+and a description of its implications. Please let us know if the vulnerability has 
+been actively exploited and/or a severe incident has happened. Please provide all 
+necessary steps to reproduce the issue. We kindly ask you to withhold full disclosure 
+of the issue until a fix is ready and the new release has been build and made available 


Suggested change

of the issue until a fix is ready and the new release has been build and made available

of the issue until a fix is ready and the new release has been built and made available

marvimarv · 2026-08-20T13:11:23Z

+5. In accordance with the CRA’s guidelines, the issue manager gives an early warning 
+about an actively exploited vulnerability and/or severe incident to ENISA’s single 
+reporting platform within 24 hours.


The CRA counts the 24 hours from becoming aware (the 72h step in "Addressing" already phrases this correctly). Also: since this list addresses the reporter, this step might fit better into "Addressing a Security Issue" (between steps 1 and 3) — the reporter doesn't act here.

Suggested change

5. In accordance with the CRA’s guidelines, the issue manager gives an early warning

about an actively exploited vulnerability and/or severe incident to ENISA’s single

reporting platform within 24 hours.

5. In accordance with the CRA's guidelines, the issue manager gives an early warning

about an actively exploited vulnerability and/or severe incident to ENISA's single

reporting platform within 24 hours of becoming aware of it.

marvimarv · 2026-08-20T13:11:23Z

 * Create one patch file per supported branch needing the fix. The patch file MUST
-be named "<ilias_version>_<title_of_fix>.patch" (e.g. "9_my-very-important-fix.patch").
-To create the patch use `git format-patch` with the option `--stdout` from the branch in which you made the fixes
+be named "<ilias_version>_<title_of_fix>.patch" (e.g. ‘11_my-very-important-fix.patch’).


Typographic quotes are risky here because people copy the example:

Suggested change

be named "<ilias_version>_<title_of_fix>.patch" (e.g. ‘11_my-very-important-fix.patch’).

be named "<ilias_version>_<title_of_fix>.patch" (e.g. "11_my-very-important-fix.patch").

marvimarv · 2026-08-20T13:11:23Z

+be named "<ilias_version>_<title_of_fix>.patch" (e.g. ‘11_my-very-important-fix.patch’).
+To create the patch use `git format-patch` with the option `--stdout` from the branch 
+in which you made the fixes
 (e.g. `git format-patch release_9 --stdout > 9_my-very-important-fix.patch`)


The example above was updated to ILIAS 11, this one still uses 9:

Suggested change

(e.g. `git format-patch release_9 --stdout > 9_my-very-important-fix.patch`)

(e.g. `git format-patch release_11 --stdout > 11_my-very-important-fix.patch`)

marvimarv · 2026-08-20T13:11:23Z

 needed to fix the issue. To make the application of the patches as easy as possible,
 **fixes for security issues MUST not contain any unrelated changes**.
-* Upload the patch files to the corresponding issue in the project "ILIAS Security"
+* Upload the patch files to the corresponding issue in the project ‘ILIAS Security’


Suggested change

* Upload the patch files to the corresponding issue in the project ‘ILIAS Security’

* Upload the patch files to the corresponding issue in the project "ILIAS Security"

Update security.md

669e0d9

Updated content incl. process changes due to CRA requirements

matthiaskunkel requested review from FraenzePacita, QualitusHartwig, corro, davidtokar, marvimarv, mbecker-databay, mjansenDatabay, rfalkenstein and tbongers-cat August 20, 2026 12:40

matthiaskunkel added improvement technical board documentation Pull requests that only update or add documentation. labels Aug 20, 2026

marvimarv requested changes Aug 20, 2026

View reviewed changes

Navigation Menu

Uh oh!

Update of security.md - #11968

Update of security.md#11968
matthiaskunkel wants to merge 1 commit into
ILIAS-eLearning:trunkfrom
matthiaskunkel:trunk

matthiaskunkel commented Aug 20, 2026

Uh oh!

marvimarv left a comment

Uh oh!

marvimarv Aug 20, 2026

Uh oh!

marvimarv Aug 20, 2026

Uh oh!

marvimarv Aug 20, 2026

Uh oh!

marvimarv Aug 20, 2026

Uh oh!

marvimarv Aug 20, 2026

Uh oh!

marvimarv Aug 20, 2026

Uh oh!

marvimarv Aug 20, 2026

Uh oh!

marvimarv Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	securely. Such instructions can be found in the document /docs/configuration/secure.md
	securely. Such instructions can be found in [docs/configuration/secure.md](../configuration/secure.md).

		The ILIAS Release Manager is responsible for packing and publishing security bugfix releases
		in accordance with the Security Group. Once a security release has been published, the

	of the issue until a fix is ready and the new release has been build and made available
	of the issue until a fix is ready and the new release has been built and made available

	be named "<ilias_version>_<title_of_fix>.patch" (e.g. ‘11_my-very-important-fix.patch’).
	be named "<ilias_version>_<title_of_fix>.patch" (e.g. "11_my-very-important-fix.patch").

	(e.g. `git format-patch release_9 --stdout > 9_my-very-important-fix.patch`)
	(e.g. `git format-patch release_11 --stdout > 11_my-very-important-fix.patch`)

	* Upload the patch files to the corresponding issue in the project ‘ILIAS Security’
	* Upload the patch files to the corresponding issue in the project "ILIAS Security"

Uh oh!

Conversation

matthiaskunkel commented Aug 20, 2026

Uh oh!

marvimarv left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants