Skip to content
This repository has been archived by the owner on Jun 28, 2023. It is now read-only.

(CII) Vulnerability Report Process #1031

Closed
pnbrown opened this issue Jul 12, 2021 · 9 comments
Closed

(CII) Vulnerability Report Process #1031

pnbrown opened this issue Jul 12, 2021 · 9 comments
Assignees
@qnetter
Labels
kind/feedback General feedback. Actionable items are converted to a different 'kind/*' owner/community Work executed by VMware community team
Milestone
v0.9.0

Comments

@pnbrown
Copy link
Contributor

pnbrown commented Jul 12, 2021

Feature Request

There are three requirements in the vulnerability report process section. Do we have a plan for compliance?

  1. The project MUST publish the process for reporting vulnerabilities on the project site.
  2. If private vulnerability reports are supported, the project MUST include how to send the information in a way that is kept private.
  3. The project's initial response time for any vulnerability report received in the last 6 months MUST be less than or equal to 14 days

Describe alternatives you've considered

N/A

Additional context

N/A
@pnbrown pnbrown added kind/feature A request for a new feature triage/needs-triage Needs triage by TCE maintainers labels Jul 12, 2021
@pnbrown
Copy link
Contributor Author

pnbrown commented Jul 12, 2021

Related is that we'll need some process for handling and notifying in the releases about patched CVEs.

@PushkarJ
Copy link
Contributor

Guessing here, but much of what is done by a VMware project that has a CII badge can be reused here e.g. velero

They have a CII badge and their answers to above questions can be found here: https://bestpractices.coreinfrastructure.org/en/projects/3811#reporting

@pnbrown
Copy link
Contributor Author

pnbrown commented Jul 12, 2021

Jonas showed me the site for the security information. Will follow up there to get this one resolved.

@joshrosso joshrosso added this to the v0.7.0 milestone Jul 15, 2021
@joshrosso joshrosso removed this from the v0.7.0 milestone Aug 10, 2021
@joshrosso joshrosso added owner/community Work executed by VMware community team kind/feedback General feedback. Actionable items are converted to a different 'kind/*' and removed triage/needs-triage Needs triage by TCE maintainers kind/feature A request for a new feature labels Aug 12, 2021
@joshrosso joshrosso added this to the v1.0.0 milestone Aug 12, 2021
@joshrosso
Copy link
Contributor

@pnbrown I reviewed @qnetter's work on our SECURITY.md file. I'm assigned this to him to get a PR in or delegate to someone in engineering to take his internal draft and create a PR.

We do check all these boxes, except that we don't have our vulnerability/CVE process in our repo yet.

@pnbrown
Copy link
Contributor Author

pnbrown commented Aug 24, 2021

Bumping this one. We can close out CII once this is completed.

@pnbrown pnbrown closed this as completed Aug 24, 2021
@pnbrown
Copy link
Contributor Author

pnbrown commented Aug 24, 2021

Did not mean to close this but it looks like it's also being tracked in #1319

@pnbrown pnbrown reopened this Aug 24, 2021
@qnetter
Copy link
Contributor

qnetter commented Aug 24, 2021 via email

@joshrosso
Copy link
Contributor

Does the recent inclusion of SECURITY.md mean that we can close this issue?

cc @pnbrown @qnetter

@pnbrown
Copy link
Contributor Author

pnbrown commented Sep 10, 2021

Yes

@pnbrown pnbrown closed this as completed Sep 10, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@qnetter qnetter

Labels
kind/feedback General feedback. Actionable items are converted to a different 'kind/*' owner/community Work executed by VMware community team
Projects
None yet
Milestone
v0.9.0
Development

No branches or pull requests
4 participants
@PushkarJ @joshrosso @pnbrown @qnetter