@@ -27,9 +27,9 @@ will not be accepted as a vulnerability.
2727
2828Documented functionality will not be considered a vulnerability.
2929For example, :mod: `pickle `, :mod: `marshal `, :mod: `shelve `, :func: `eval `,
30- and :func: `exec ` are documented to execute arbitrary Python code that is supplied
31- as data. The :mod: `ctypes ` module is documented to enable modifying arbitrary
32- locations in memory.
30+ and :func: `exec ` are documented to execute arbitrary Python code that is
31+ supplied as data. The :mod: `ctypes ` module is documented to enable modifying
32+ arbitrary locations in memory.
3333
3434Vulnerabilities must not depend on malicious control of Python's launch
3535conditions, including command line arguments, environment variables, or
@@ -53,12 +53,12 @@ What versions of Python accept reports?
5353---------------------------------------
5454
5555Python accepts vulnerability reports and will
56- assign CVE IDs for :ref: `supported Python versions <branchstatus >` that have a status of
57- :ref: `"bugfix" or "security" <version-status-key >`. Versions that are not yet
58- stable (status of :ref: `"feature" or "prerelease" <version-status-key >`) are not
59- eligible for CVE IDs. If the vulnerability only exists in prerelease versions
60- (alphas, betas, release candidates), then the issue should be reported as a
61- regular bug.
56+ assign CVE IDs for :ref: `supported Python versions <branchstatus >` that have a
57+ status of :ref: `"bugfix" or "security" <version-status-key >`. Versions that are
58+ not yet stable (status of :ref: `"feature" or "prerelease" <version-status-key >`)
59+ are not eligible for CVE IDs. If the vulnerability only exists in prerelease
60+ versions (alphas, betas, release candidates), then the issue should be reported
61+ as a regular bug.
6262Prior to submitting a report, check whether the issue has already been
6363resolved on the ``main `` branch and only requires backporting.
6464
@@ -103,7 +103,6 @@ How to submit a vulnerability report?
103103-------------------------------------
104104
105105Submit all potential security vulnerability reports for CPython
106- to GitHub Security Advisories
107106by `opening a new ticket <GHSA >`__.
108107Do not open a public GitHub issue to report a security vulnerability.
109108For all other projects (such as pip, python.org and tools) or if you're
@@ -129,8 +128,8 @@ Code of conduct
129128Well-being and safety of the Python Security Response Team members is
130129prioritized over the technical merit of vulnerability reports.
131130Despite communications being private, vulnerability reporting is subject
132- to the `PSF Code of Conduct `_. Violations will be reported to the Code of Conduct
133- team with undisclosed vulnerability information removed, if applicable.
131+ to the `PSF Code of Conduct `_. Violations will be reported to the Code of
132+ Conduct team with undisclosed vulnerability information removed, if applicable.
134133
135134.. _GHSA : https://github.com/python/cpython/security/advisories/new
136135.. _PSF Code of Conduct : https://policies.python.org/python.org/code-of-conduct/
0 commit comments