[Starlingx-discuss] Heads Up: Adopting CVSS v3 for the monthly Starlingx CVE scans

Khalil, Ghada Ghada.Khalil at windriver.com
Sat Oct 29 01:37:59 UTC 2022


Hello all,
The StarlingX Security team is planning to adopt CVSS v3 (moving from CVSS v2) for the monthly StarlingX CVE scans in stx.8.0 as part of the Debian transition. CVSS v3 is a more recent version of the CVSS spec and is a move in the right direction.

The StarlingX CVE policy has been updated accordingly: https://wiki.openstack.org/wiki/StarlingX/Security/CVE_Support_Policy
See the last slide for the proposed CVE fix criteria.

Regards,
Ghada
stx security PL



More information about the Starlingx-discuss mailing list