[Starlingx-discuss] CVE Support and Scanning

[Victor Rodriguez]

On Mon, Feb 4, 2019 at 2:25 PM Michel Thebeau
<michel.thebeau at windriver.com> wrote:
>
> Hi Victor,
>
> > My recommendation will be to use the highest one despite if
> > the score came from V2 or V3
>
> The two sets of metrics are not comparable.  StarlingX policy should
> refer to either CVSS v2 or v3.
>

But slide in the wiki say : Criticality >= 7 , if V2 = 5 adn V3 =8
shoudl that CVE be consider as Criticality >= 7 ?
My observation is that we shoudl specify Criticality >= 7 ( for either
V2 or V3 )

> > One more question, when you said critical issues are fixed
> > if corrections are available upstream it means that...
>
> The text of one of the slides has written "StarlingX depends on the
> upstream OS community to fix CVEs".  Is this reference to upstream you
> intend?  In that text 'OS community' would refer to CentOS community
> rather than the example MariaDB community.
>

Ok, thanks for the clarification.
I think that there might be some special cases where we might prompt
to apply a CVE patch before CentOS, but that might have to be desided
in the security meeeting when they analyze the CVEs

>
> M
>
>
> On Mon, 2019-02-04 at 13:26 -0600, Victor Rodriguez wrote:
> > On Mon, Feb 4, 2019 at 12:49 PM Young, Ken <Ken.Young at windriver.com>
> > wrote:
> > >
> > >
> > > Team,
> > >
> > >
> > >
> > > A “Lights On” feature for the 2019.05 release is “CVE
> > > Upgrades”.  This feature will enable ongoing security updates for
> > > the master branch and selectively provide CVE corrective content to
> > > supported releases.  The first step for this feature is to define a
> > > policy.  With the help of the Starling X security team, a draft of
> > > this policy has been provided below:
> > >
> > >
> > >
> > > https://wiki.openstack.org/wiki/StarlingX/Security/CVE_Support_Poli
> > > cy
> > >
> > >
> > >
> > > Please review and provide comments.  I plan to reserve a spot on
> > > the Community call for any discussion on Wednesday and start the
> > > discussion with the build team to identify tools to support this
> > > policy on Thursday.
> >
> > Question on the last slide you propose a formula as
> >
> > Criticality >= 7
> >
> > What standard are you plan to use? CVSS v3.0 or v2.0
> >
> > For example, taking this MariaDB
> >
> > https://nvd.nist.gov/vuln/detail/CVE-2017-15365
> >
> > Base Score: 8.8 HIGH in V3 and 6.5 MEDIUM in V2
> >
> > My recommendation will be to use the highest one despite if the score
> > came from V2 or V3
> > However, I think we should specify that somewhere
> >
> > One more question, when you said critical issues are fixed if
> > corrections are available upstream it means that ( taking the
> > previous
> > example ) if MariaDB provides a Patch, is merged in master and
> > released in the latest release,  like in the previous example :
> > https://github.com/MariaDB/server/commit/0b5a5258abbeaf8a0c3a18c7e753
> > 699787fdf46e
> >
> > But CentOS has not taken it yet, are we OK to apply this patch in STX
> > until CentOS apply in incoming future?
> >
> > Regards
> >
> > Victor R
> > >
> > >
> > >
> > > Regards,
> > >
> > > Ken Y
> > >
> > > _______________________________________________
> > > Starlingx-discuss mailing list
> > > Starlingx-discuss at lists.starlingx.io
> > > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discus
> > > s
> > _______________________________________________
> > Starlingx-discuss mailing list
> > Starlingx-discuss at lists.starlingx.io
> > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss