[Starlingx-discuss] CVE Support and Scanning

[Young, Ken]

See inline.

On 2019-02-04, 2:26 PM, "Victor Rodriguez" <vm.rod25 at gmail.com> wrote:

    On Mon, Feb 4, 2019 at 12:49 PM Young, Ken <Ken.Young at windriver.com> wrote:
    >
    > Team,
    >
    >
    >
    > A “Lights On” feature for the 2019.05 release is “CVE Upgrades”.  This feature will enable ongoing security updates for the master branch and selectively provide CVE corrective content to supported releases.  The first step for this feature is to define a policy.  With the help of the Starling X security team, a draft of this policy has been provided below:
    >
    >
    >
    > https://wiki.openstack.org/wiki/StarlingX/Security/CVE_Support_Policy
    >
    >
    >
    > Please review and provide comments.  I plan to reserve a spot on the Community call for any discussion on Wednesday and start the discussion with the build team to identify tools to support this policy on Thursday.
    
    
    Question on the last slide you propose a formula as
    
    Criticality >= 7
    
    What standard are you plan to use? CVSS v3.0 or v2.0
    
I am suggesting we start with v2.  I need to look into v3 a little more.

    For example, taking this MariaDB
    
    https://nvd.nist.gov/vuln/detail/CVE-2017-15365
    
    Base Score: 8.8 HIGH in V3 and 6.5 MEDIUM in V2
    
    My recommendation will be to use the highest one despite if the score
    came from V2 or V3
    
    However, I think we should specify that somewhere
    
Agreed.

    One more question, when you said critical issues are fixed if
    corrections are available upstream it means that ( taking the previous
    example ) if MariaDB provides a Patch, is merged in master and
    released in the latest release,  like in the previous example :
    https://github.com/MariaDB/server/commit/0b5a5258abbeaf8a0c3a18c7e753699787fdf46e
    
    But CentOS has not taken it yet, are we OK to apply this patch in STX
    until CentOS apply in incoming future?
    
We will wait for CentOS.  We are in the process of patch elimination.  I do not to carry more.

    Regards
    
    Victor R
    >
    >
    > Regards,
    >
    > Ken Y
    >
    > _______________________________________________
    > Starlingx-discuss mailing list
    > Starlingx-discuss at lists.starlingx.io
    > http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss