starlingx/docs
Code Issues Proposed changes

Merge "Updated CVSS v3.x"

Browse Source
This commit is contained in:
Zuul 2023-06-26 21:19:17 +00:00 committed by Gerrit Code Review
commit 1bdfec3baa
2 changed files with 41 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
doc/source/_includes/cve-maintenance-0eaf7f8697bc.rest
View File

@ -2,14 +2,3 @@
.. begin-CVE .. begin-CVE
.. end-CVE .. end-CVE
.. CentOS-begin
.. CentOS-end
.. CVE-visibility-begin
.. CVE-visibility-end
.. Debian-begin
.. Debian-end
.. CVE-visibility-1-begin
.. CVE-visibility-1-end

90
doc/source/security/kubernetes/cve-maintenance-723cd9dd54b3.rst
View File

@ -4,81 +4,61 @@
CVE Maintenance CVE Maintenance
=============== ===============
On a monthly basis, the master development branch of |prod| is scanned for
|CVE|'s and the reports that are generated are reviewed by the Security team.
.. only:: partner .. only:: partner
.. include:: /_includes/cve-maintenance-0eaf7f8697bc.rest .. include:: /_includes/cve-maintenance-0eaf7f8697bc.rest
:start-after: begin-CVE :start-after: begin-CVE
:end-before: end-CVE :end-before: end-CVE
.. only:: starlingx .. only:: starlingx
For |CVE|'s which meet StarlingX's ``CVE Fix Criteria Policy`` as documented On a monthly basis, the master development branch of StarlingX is scanned
below, fixes are provided for the |CVE| in the StarlingX master branch. for CVEs using the third party tool ``Vulscan`` to provide an unbiased view
of vulnerabilities. The generated reports are reviewed by the Security team.
For |CVE|'s which meet StarlingX's CVE Fix Criteria Policy as documented
below, fixes are provided in the StarlingX master branch.
For Debian-based versions of |prod| |deb-release-ver|: .. note::
.. only:: partner There are no scans executed or |CVE| fixes implemeneted on the released
versions / branches on StarlingX.
.. include:: /_includes/cve-maintenance-0eaf7f8697bc.rest For the current Debian-based versions of StarlingX:
:start-after: Debian-begin
:end-before: Debian-end
- The third party tool ``Vulscan`` is used to scan for |CVE|'s to provide an - |CVSS| v3.x base scores and base metrics are used in the |CVE| fix criteria
unbiased view of vulnerabilities
- |CVSS| v3 base scores and base metrics are used in the |CVE| fix criteria - The |CVE| ``Fix Criteria Policy`` is:
- The |CVE| ``Fix Criteria Policy`` is: - Main Fix Criteria
- Main Fix Criteria - |CVSS| v3.x Base score >= 7.0
- Base Metrics has the following:
- |CVSS| v3 Base score >= 7.0 - Attack Vector: Network
- Base Metrics has the following: - Attack Complexity: Low
- Privileges Required: None or Low
- Availability Impact: High or Low
- User Interaction: None
- A correction is available upstream
- Attack Vector: Network - OR, visibility is HIGH and a correction is available upstream
- Attack Complexity: Low
- Privileges Required: None or Low
- Availability Impact: High or Low
- User Interaction: None
- A correction is available upstream
- OR, visibility is HIGH and a correction is available upstream In the past, for older CentOS-based versions of StarlingX:
.. only:: partner - |CVSS| v2 base scores and base vectors were used in the |CVE| fix criteria
.. include:: /_includes/cve-maintenance-0eaf7f8697bc.rest - The |CVE| ``Fix Criteria Policy`` was:
:start-after: CVE-visibility-1-begin
:end-before: CVE-visibility-1-end
For older CentOS-based versions of |prod|: - Main Fix Criteria
.. only:: partner - |CVSS| v2 Base score >= 7.0
- Base Vector has the following:
.. include:: /_includes/cve-maintenance-0eaf7f8697bc.rest - Access Vector: Network
:start-after: CentOS-begin - Access Complexity: Low
:end-before: CentOS-end - Authentication: None or Single
- Availability Impact: Partial/Complete
- |CVSS| v2 base scores and base vectors are used in the |CVE| fix criteria - A correction was available upstream
- The |CVE| ``Fix Criteria Policy`` is:
- Main Fix Criteria - OR, visibility was HIGH and a correction was available upstream
- |CVSS| v2 Base score >= 7.0
- Base Vector has the following:
- Access Vector: Network
- Access Complexity: Low
- Authentication: None or Single
- Availability Impact: Partial/Complete
- A correction is available upstream
- OR, visibility is HIGH and a correction is available upstream
.. only:: partner
.. include:: /_includes/cve-maintenance-0eaf7f8697bc.rest
:start-after: CVE-visibility-begin
:end-before: CVE-visibility-end