[Starlingx-discuss] CVE Support and Scanning

[Michel Thebeau]

Hi Victor,

> My recommendation will be to use the highest one despite if
> the score came from V2 or V3

The two sets of metrics are not comparable.  StarlingX policy should
refer to either CVSS v2 or v3.

> One more question, when you said critical issues are fixed
> if corrections are available upstream it means that...

The text of one of the slides has written "StarlingX depends on the
upstream OS community to fix CVEs".  Is this reference to upstream you
intend?  In that text 'OS community' would refer to CentOS community
rather than the example MariaDB community.


M


On Mon, 2019-02-04 at 13:26 -0600, Victor Rodriguez wrote:
> On Mon, Feb 4, 2019 at 12:49 PM Young, Ken <Ken.Young at windriver.com>
> wrote:
> > 
> > 
> > Team,
> > 
> > 
> > 
> > A “Lights On” feature for the 2019.05 release is “CVE
> > Upgrades”.  This feature will enable ongoing security updates for
> > the master branch and selectively provide CVE corrective content to
> > supported releases.  The first step for this feature is to define a
> > policy.  With the help of the Starling X security team, a draft of
> > this policy has been provided below:
> > 
> > 
> > 
> > https://wiki.openstack.org/wiki/StarlingX/Security/CVE_Support_Poli
> > cy
> > 
> > 
> > 
> > Please review and provide comments.  I plan to reserve a spot on
> > the Community call for any discussion on Wednesday and start the
> > discussion with the build team to identify tools to support this
> > policy on Thursday.
> 
> Question on the last slide you propose a formula as
> 
> Criticality >= 7
> 
> What standard are you plan to use? CVSS v3.0 or v2.0
> 
> For example, taking this MariaDB
> 
> https://nvd.nist.gov/vuln/detail/CVE-2017-15365
> 
> Base Score: 8.8 HIGH in V3 and 6.5 MEDIUM in V2
> 
> My recommendation will be to use the highest one despite if the score
> came from V2 or V3
> However, I think we should specify that somewhere
> 
> One more question, when you said critical issues are fixed if
> corrections are available upstream it means that ( taking the
> previous
> example ) if MariaDB provides a Patch, is merged in master and
> released in the latest release,  like in the previous example :
> https://github.com/MariaDB/server/commit/0b5a5258abbeaf8a0c3a18c7e753
> 699787fdf46e
> 
> But CentOS has not taken it yet, are we OK to apply this patch in STX
> until CentOS apply in incoming future?
> 
> Regards
> 
> Victor R
> > 
> > 
> > 
> > Regards,
> > 
> > Ken Y
> > 
> > _______________________________________________
> > Starlingx-discuss mailing list
> > Starlingx-discuss at lists.starlingx.io
> > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discus
> > s
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss