1"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([["10833"],{26498(e,i,n){n.r(i),n.d(i,{metadata:()=>t,default:()=>h,frontMatter:()=>r,contentTitle:()=>a,toc:()=>c,assets:()=>l});var t=JSON.parse('{"id":"policies/cve","title":"CVE Process","description":"OpenBao\'s policy around security vulnerabilities reported by third-party\\ndisclosures.","source":"@site/content/community/policies/cve.mdx","sourceDirName":"policies","slug":"/policies/cve","permalink":"/community/policies/cve","draft":false,"unlisted":false,"editUrl":"https://github.com/openbao/openbao/tree/main/website/content/community/policies/cve.mdx","tags":[],"version":"current","frontMatter":{"sidebar_label":"CVE Process","description":"OpenBao\'s policy around security vulnerabilities reported by third-party\\ndisclosures."},"sidebar":"community","previous":{"title":"Open Source Project Security Baseline","permalink":"/community/policies/osps-baseline"},"next":{"title":"Repo Setup","permalink":"/community/policies/repo-setup"}}'),s=n(94686),o=n(44812);let r={sidebar_label:"CVE Process",description:"OpenBao's policy around security vulnerabilities reported by third-party\ndisclosures."},a="CVE Process",l={},c=[{value:"Overview",id:"overview",level:2},{value:"Notification Mechanisms",id:"notification-mechanisms",level:3},{value:"Confirmation Process",id:"confirmation-process",level:3},{value:"Patch Development and Release",id:"patch-development-and-release",level:3}];function d(e){let i={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",ol:"ol",p:"p",...(0,o.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(i.header,{children:(0,s.jsx)(i.h1,{id:"cve-process",children:"CVE Process"})}),"\n",(0,s.jsx)(i.h2,{id:"overview",children:"Overview"}),"\n",(0,s.jsx)(i.p,{children:"The process has the following main phases:"}),"\n",(0,s.jsxs)(i.ol,{children:["\n",(0,s.jsx)(i.li,{children:"Notification via security mailing list (preferred) or issue (not\npreferential unless existing disclosure exists)."}),"\n",(0,s.jsx)(i.li,{children:"Confirmation of issue: 7 days"}),"\n",(0,s.jsx)(i.li,{children:"Patch development and release: 90 days"}),"\n"]}),"\n",(0,s.jsx)(i.p,{children:"Total time: 97 days."}),"\n",(0,s.jsx)(i.h3,{id:"notification-mechanisms",children:"Notification Mechanisms"}),"\n",(0,s.jsx)(i.p,{children:"OpenBao tracks the following sources as valid vulnerability notification\nchannels:"}),"\n",(0,s.jsxs)(i.ol,{children:["\n",(0,s.jsxs)(i.li,{children:["The security mailing list, ",(0,s.jsx)(i.code,{children:"[email protected]"}),". See\n",(0,s.jsx)(i.a,{href:"https://github.com/openbao/.github/blob/main/SECURITY.md",children:"SECURITY.md"}),".\nThis should be preferred, especially for embargoed issues."]}),"\n",(0,s.jsxs)(i.li,{children:["The private repository issues, e.g., ",(0,s.jsx)(i.a,{href:"https://github.com/openbao/dev-wg/security/advisories/new",children:(0,s.jsx)(i.code,{children:"openbao/openbao"})}),"."]}),"\n",(0,s.jsxs)(i.li,{children:["The HashiCorp Vault security bulletin, ",(0,s.jsx)(i.a,{href:"https://discuss.hashicorp.com/tag/security-vault/",children:"https://discuss.hashicorp.com/tag/security-vault/"}),"."]}),"\n"]}),"\n",(0,s.jsx)(i.p,{children:"Reports by other mechanisms will be referred to the security mailing list and\nnot considered valid reports."}),"\n",(0,s.jsx)(i.p,{children:"The security mailing list includes all active voting Dev WG members who have\nopted in to participating in the security patching process, plus\nrepresentatives from the Linux Foundation for oversight. In-progress reports\nwill be kept confidential through the disclosure period, with need-to-know,\nlimited disclosure within participating organizations."}),"\n",(0,s.jsx)(i.h3,{id:"confirmation-process",children:"Confirmation Process"}),"\n",(0,s.jsx)(i.p,{children:"A 7-day process from submission will determine the validity of the report. An\nacknowledgement should be sent quickly by a triaging individual; all\nsubsequent communication with the reporter should include the mailing list. If\
1nconfirmed, a new security advisory should be acquired on GitHub with CVE\nassignment. This will allow creation of a private, restricted repository with\nlimited visibility."}),"\n",(0,s.jsx)(i.p,{children:"The security list members should coordinate triage and assign a patch\ndeveloper."}),"\n",(0,s.jsx)(i.h3,{id:"patch-development-and-release",children:"Patch Development and Release"}),"\n",(0,s.jsx)(i.p,{children:"From the confirmation of the vulnerability, we seek to have a maximum 90-day\nwindow or less to patch all vulnerabilities in a released version of OpenBao.\nIn instances where we can get a patch out sooner, we should endeavor to do\nso."}),"\n",(0,s.jsx)(i.p,{children:"For High or Critical severity issues, we should issue an announcement on all\nrelevant channels one week before release, indicating that a security release\nis eminent. These security issues would be sufficient to trigger a dedicated\nrelease of the last patch series or a new minor release if applicable."}),"\n",(0,s.jsx)(i.p,{children:"Patch development should remain confidential and limited to active mailing\nlist members. Additional members may be added on a one-off basis, as needed\nfor expertise and development capacity, given reasonable consensus among the\nsecurity list members."}),"\n",(0,s.jsx)(i.p,{children:"Embargoed patches will not be disclosed outside of the organizations of Dev\nWG voting members. These organizations may run patches on their own\ninfrastructure, e.g., for internal or publicly accessible instances, but must\nnot ship patch sources to third-party organizations. These organizations may\nship patched binaries to third-party organizations with which they have a\nstrict NDA with but must not reveal sensitive details of the vulnerabilities\nto them until after they're publicly disclosed."}),"\n",(0,s.jsx)(i.admonition,{type:"note",children:(0,s.jsx)(i.p,{children:"Our intention is to have greater confidence in CVE patches affecting\nhard-to-test or proprietary configurations ahead of general availability, in a\nsafe, controlled manner."})})]})}function h(e={}){let{wrapper:i}={...(0,o.R)(),...e.components};return i?(0,s.jsx)(i,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},44812(e,i,n){n.d(i,{R:()=>r,x:()=>a});var t=n(92990);let s={},o=t.createContext(s);function r(e){let i=t.useContext(o);return t.useMemo(function(){return"function"==typeof e?e(i):{...i,...e}},[i,e])}function a(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),t.createElement(o.Provider,{value:i},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.