net/bnxt: fix enable/disable VLAN filtering

[dpdk.git] / doc / guides / contributing / vulnerability.rst

diff --git a/doc/guides/contributing/vulnerability.rst b/doc/guides/contributing/vulnerability.rst
index a4bef48..5484119 100644 (file)
--- a/doc/guides/contributing/vulnerability.rst
+++ b/doc/guides/contributing/vulnerability.rst
@@ -194,6 +194,14 @@ Downstream stakeholders (in `security-prerelease list
 * Major DPDK users, considered trustworthy by the technical board, who
   have made the request to `techboard@dpdk.org <mailto:techboard@dpdk.org>`_
 
+The `OSS security private mailing list mailto:distros@vs.openwall.org>` will
+also be contacted one week before the end of the embargo, as indicated by `the
+OSS-security process <https://oss-security.openwall.org/wiki/mailing-lists/distros>`
+and using the PGP key listed on the same page, describing the details of the
+vulnerability and sharing the patch[es]. Distributions and major vendors follow
+this private mailing list, and it functions as a single point of contact for
+embargoed advance notices for open source projects.
+
 The security advisory will be based on below template,
 and will be sent signed with a security team's member GPG key.
 
@@ -276,8 +284,9 @@ Releases on Monday to Wednesday are preferred, so that system administrators
 do not have to deal with security updates over the weekend.
 
 The security advisory is posted
-to `announce@dpdk.org <mailto:announce@dpdk.org>`_
-as soon as the patches are pushed to the appropriate branches.
+to `announce@dpdk.org <mailto:announce@dpdk.org>`_ and to `the public OSS-security
+mailing list <mailto:oss-security@lists.openwall.com>` as soon as the patches
+are pushed to the appropriate branches.
 
 Patches are then sent to `dev@dpdk.org <mailto:dev@dpdk.org>`_
 and `stable@dpdk.org <mailto:stable@dpdk.org>`_ accordingly.