[Starlingx-discuss] CVE Support and Scanning

[Michel Thebeau]

On Mon, 2019-02-04 at 14:41 -0600, Victor Rodriguez wrote:
> On Mon, Feb 4, 2019 at 2:25 PM Michel Thebeau
> <michel.thebeau at windriver.com> wrote:
> > 
> > 
> > Hi Victor,
> > 
> > > 
> > > My recommendation will be to use the highest one despite if
> > > the score came from V2 or V3
> > The two sets of metrics are not comparable.  StarlingX policy
> > should
> > refer to either CVSS v2 or v3.
> > 
> But slide in the wiki say : Criticality >= 7 , if V2 = 5 adn V3 =8
> shoudl that CVE be consider as Criticality >= 7 ?
> My observation is that we shoudl specify Criticality >= 7 ( for
> either
> V2 or V3 )


I believe that Ken has a particular metric in mind, which was not
documented.  The value of '7' is specific to the metric not
documentated.  There is a hint in the document that the value '7' is
for 'critical' CVEs issues. 

... refer to this document:
https://nvd.nist.gov/vuln-metrics/cvss

'7' is the boundary for the highest rating of CVSS v2.  Where as CVSS
v3 lists critical as >9.0



> 
> > 
> > > 
> > > One more question, when you said critical issues are fixed
> > > if corrections are available upstream it means that...
> > The text of one of the slides has written "StarlingX depends on the
> > upstream OS community to fix CVEs".  Is this reference to upstream
> > you
> > intend?  In that text 'OS community' would refer to CentOS
> > community
> > rather than the example MariaDB community.
> > 
> Ok, thanks for the clarification.
> I think that there might be some special cases where we might prompt
> to apply a CVE patch before CentOS, but that might have to be desided
> in the security meeeting when they analyze the CVEs


I expect that it is unlikely a team in StarlingX will match the
proficiency of the teams behind CentOS.  But I agree that the StarlingX
community will discuss these things.

M


> 
> > 
> > 
> > M
> > 
> > 
> > On Mon, 2019-02-04 at 13:26 -0600, Victor Rodriguez wrote:
> > > 
> > > On Mon, Feb 4, 2019 at 12:49 PM Young, Ken <Ken.Young at windriver.c
> > > om>
> > > wrote:
> > > > 
> > > > 
> > > > 
> > > > Team,
> > > > 
> > > > 
> > > > 
> > > > A “Lights On” feature for the 2019.05 release is “CVE
> > > > Upgrades”.  This feature will enable ongoing security updates
> > > > for
> > > > the master branch and selectively provide CVE corrective
> > > > content to
> > > > supported releases.  The first step for this feature is to
> > > > define a
> > > > policy.  With the help of the Starling X security team, a draft
> > > > of
> > > > this policy has been provided below:
> > > > 
> > > > 
> > > > 
> > > > https://wiki.openstack.org/wiki/StarlingX/Security/CVE_Support_
> > > > Poli
> > > > cy
> > > > 
> > > > 
> > > > 
> > > > Please review and provide comments.  I plan to reserve a spot
> > > > on
> > > > the Community call for any discussion on Wednesday and start
> > > > the
> > > > discussion with the build team to identify tools to support
> > > > this
> > > > policy on Thursday.
> > > Question on the last slide you propose a formula as
> > > 
> > > Criticality >= 7
> > > 
> > > What standard are you plan to use? CVSS v3.0 or v2.0
> > > 
> > > For example, taking this MariaDB
> > > 
> > > https://nvd.nist.gov/vuln/detail/CVE-2017-15365
> > > 
> > > Base Score: 8.8 HIGH in V3 and 6.5 MEDIUM in V2
> > > 
> > > My recommendation will be to use the highest one despite if the
> > > score
> > > came from V2 or V3
> > > However, I think we should specify that somewhere
> > > 
> > > One more question, when you said critical issues are fixed if
> > > corrections are available upstream it means that ( taking the
> > > previous
> > > example ) if MariaDB provides a Patch, is merged in master and
> > > released in the latest release,  like in the previous example :
> > > https://github.com/MariaDB/server/commit/0b5a5258abbeaf8a0c3a18c7
> > > e753
> > > 699787fdf46e
> > > 
> > > But CentOS has not taken it yet, are we OK to apply this patch in
> > > STX
> > > until CentOS apply in incoming future?
> > > 
> > > Regards
> > > 
> > > Victor R
> > > > 
> > > > 
> > > > 
> > > > 
> > > > Regards,
> > > > 
> > > > Ken Y
> > > > 
> > > > _______________________________________________
> > > > Starlingx-discuss mailing list
> > > > Starlingx-discuss at lists.starlingx.io
> > > > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-di
> > > > scus
> > > > s
> > > _______________________________________________
> > > Starlingx-discuss mailing list
> > > Starlingx-discuss at lists.starlingx.io
> > > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-disc
> > > uss