[Starlingx-discuss] CVE Support and Scanning

[Victor Rodriguez]

On Mon, Feb 4, 2019 at 3:01 PM Michel Thebeau
<michel.thebeau at windriver.com> wrote:
>
> On Mon, 2019-02-04 at 14:41 -0600, Victor Rodriguez wrote:
> > On Mon, Feb 4, 2019 at 2:25 PM Michel Thebeau
> > <michel.thebeau at windriver.com> wrote:
> > >
> > >
> > > Hi Victor,
> > >
> > > >
> > > > My recommendation will be to use the highest one despite if
> > > > the score came from V2 or V3
> > > The two sets of metrics are not comparable.  StarlingX policy
> > > should
> > > refer to either CVSS v2 or v3.
> > >
> > But slide in the wiki say : Criticality >= 7 , if V2 = 5 adn V3 =8
> > shoudl that CVE be consider as Criticality >= 7 ?
> > My observation is that we shoudl specify Criticality >= 7 ( for
> > either
> > V2 or V3 )
>
>
> I believe that Ken has a particular metric in mind, which was not
> documented.  The value of '7' is specific to the metric not
> documentated.  There is a hint in the document that the value '7' is
> for 'critical' CVEs issues.
>
> ... refer to this document:
> https://nvd.nist.gov/vuln-metrics/cvss
>
> '7' is the boundary for the highest rating of CVSS v2.  Where as CVSS
> v3 lists critical as >9.0
>

Ok , then Based on NVD Vulnerability Severity Ratings  7 is ok for both V2 or V3

We cond then said in the wiki that if CVE critilarity is >= High ...


>
>
> >
> > >
> > > >
> > > > One more question, when you said critical issues are fixed
> > > > if corrections are available upstream it means that...
> > > The text of one of the slides has written "StarlingX depends on the
> > > upstream OS community to fix CVEs".  Is this reference to upstream
> > > you
> > > intend?  In that text 'OS community' would refer to CentOS
> > > community
> > > rather than the example MariaDB community.
> > >
> > Ok, thanks for the clarification.
> > I think that there might be some special cases where we might prompt
> > to apply a CVE patch before CentOS, but that might have to be desided
> > in the security meeeting when they analyze the CVEs
>
>
> I expect that it is unlikely a team in StarlingX will match the
> proficiency of the teams behind CentOS.  But I agree that the StarlingX
> community will discuss these things.
>
I have seen cases before, as CVE mantianer of an OS for some time
there were times were the severity of the CVE make us really urgent to
update the package and release a new version of the OS, our mindset
was security first.

As an open comunity I woudl like to hear more feedabck from multiple
users and developers

Regards

Victor
> M
>
>
> >
> > >
> > >
> > > M
> > >
> > >
> > > On Mon, 2019-02-04 at 13:26 -0600, Victor Rodriguez wrote:
> > > >
> > > > On Mon, Feb 4, 2019 at 12:49 PM Young, Ken <Ken.Young at windriver.c
> > > > om>
> > > > wrote:
> > > > >
> > > > >
> > > > >
> > > > > Team,
> > > > >
> > > > >
> > > > >
> > > > > A “Lights On” feature for the 2019.05 release is “CVE
> > > > > Upgrades”.  This feature will enable ongoing security updates
> > > > > for
> > > > > the master branch and selectively provide CVE corrective
> > > > > content to
> > > > > supported releases.  The first step for this feature is to
> > > > > define a
> > > > > policy.  With the help of the Starling X security team, a draft
> > > > > of
> > > > > this policy has been provided below:
> > > > >
> > > > >
> > > > >
> > > > > https://wiki.openstack.org/wiki/StarlingX/Security/CVE_Support_
> > > > > Poli
> > > > > cy
> > > > >
> > > > >
> > > > >
> > > > > Please review and provide comments.  I plan to reserve a spot
> > > > > on
> > > > > the Community call for any discussion on Wednesday and start
> > > > > the
> > > > > discussion with the build team to identify tools to support
> > > > > this
> > > > > policy on Thursday.
> > > > Question on the last slide you propose a formula as
> > > >
> > > > Criticality >= 7
> > > >
> > > > What standard are you plan to use? CVSS v3.0 or v2.0
> > > >
> > > > For example, taking this MariaDB
> > > >
> > > > https://nvd.nist.gov/vuln/detail/CVE-2017-15365
> > > >
> > > > Base Score: 8.8 HIGH in V3 and 6.5 MEDIUM in V2
> > > >
> > > > My recommendation will be to use the highest one despite if the
> > > > score
> > > > came from V2 or V3
> > > > However, I think we should specify that somewhere
> > > >
> > > > One more question, when you said critical issues are fixed if
> > > > corrections are available upstream it means that ( taking the
> > > > previous
> > > > example ) if MariaDB provides a Patch, is merged in master and
> > > > released in the latest release,  like in the previous example :
> > > > https://github.com/MariaDB/server/commit/0b5a5258abbeaf8a0c3a18c7
> > > > e753
> > > > 699787fdf46e
> > > >
> > > > But CentOS has not taken it yet, are we OK to apply this patch in
> > > > STX
> > > > until CentOS apply in incoming future?
> > > >
> > > > Regards
> > > >
> > > > Victor R
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > Regards,
> > > > >
> > > > > Ken Y
> > > > >
> > > > > _______________________________________________
> > > > > Starlingx-discuss mailing list
> > > > > Starlingx-discuss at lists.starlingx.io
> > > > > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-di
> > > > > scus
> > > > > s
> > > > _______________________________________________
> > > > Starlingx-discuss mailing list
> > > > Starlingx-discuss at lists.starlingx.io
> > > > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-disc
> > > > uss