Security Vulnerability reporting and fixing in Pulp

[VrindaMarwah]

Hi, I wanted to understand how frequently are the security vulnerabilities addressed in Pulp latest versions? Is there any place where I can view the scan reports to identify what issues have already been addressed? In case we find a security vulnerability, what is the procedure to report it to Pulp?

[dralley]

Well, what do you mean by how frequently are they addressed? We try to make sure our dependencies are up to date (insofar as that doesn't create it's own risks) but we have not had very many security issues reported against Pulp directly.

[pedro-psb]

You can report it at pulp-security@redhat.com (https://pulpproject.org/help/community/get-involved/#reporting)

[pedro-psb]

Also here: https://github.com/pulp/.github/blob/main/SECURITY.md