There MUST be no unpatched vulnerabilities of medium or high severity that have been publicly known for more than 60 days.
The vulnerability must be patched and released by the project itself (patches may be developed elsewhere). A vulnerability becomes publicly known (for this purpose) once it has a CVE with publicly released non-paywalled information (reported, for example, in the National Vulnerability Database
) or when the project has been informed and the information has been released to the public (possibly by the project). A vulnerability is medium to high severity if its CVSS 2.0
base score is 4 or higher. Note
: this means that users might be left vulnerable to all attackers worldwide for up to 60 days. This criterion is often much easier to meet than what Google recommends in Rebooting responsible disclosure
, because Google recommends that the 60-day period start when the project is notified even
if the report is not public. Rationale
: We intentionally chose to start measurement from the time of public knowledge, and not from the time reported to the project, because this is much easier to measure and verify by those outside the project.
(Optional) Please explain how this is met, including 1+ key URLs.
Please explain why it's okay this is unmet, including 1+ key URLs.
(Optional) Please explain why this is not applicable (N/A), including 1+ key URLs.