84746 - No "security" severity level in bugzilla

Status: VERIFIED WONTFIX

(bugzilla.mozilla.org :: Administration, task)

Description

[Steve Holland]

Security issues demand and deserve special attention. Hence a "security" bug
classification is essential. Bugzilla should list a severity level of "security"
as superior to "blocker."

Comment 1

[Asa Dotzler [:asa]]

we have assignees, components and groups that cover this. No need for a security
item in the Severity list.

Comment 2

[Steve Holland]

Perhaps there should be specific instructions for reporting security-related
bugs? e.g. "always report security-related bugs to Component:Security rather
than the erroneous component". When I was reporting a bug, it was not at all
obvious to me how to flag it as "security related"

I mentioned this because Red Hat's bugzilla uses security as a priority level,
and that works quite nicely. 

Comment 3

[timeless]

vrfy wontfix
Always contact mstoltz or the PSM/NSS people [depending on the issue]?

Comment 4

[Mitchell Stoltz (not reading bugmail)]

We do need a well-known way to report a bug as security-related. We have
something coming for this.