Skip to content

Commit 824e8dd

Browse files
mtardymtardy
committed
do not commit me: this is for WIP
Signed-off-by: Mahe Tardy <[email protected]>
1 parent c23012a commit 824e8dd

File tree

5 files changed

+184
-1
lines changed

5 files changed

+184
-1
lines changed

‎sig-security-tooling/src/templates/email.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
_Use this email template for publicly disclosing security vulnerabilities._
2+
3+
_The email should be **concise** and **actionable**. Assume the audience are not
4+
Kubernetes developers. Non-actionable information (e.g. technical discussion of
5+
the vulnerability) should be deferred to the [vulnerability
6+
issue](vulnerability-announcement-issue.md)._
7+
8+
TO: `[email protected], [email protected], [email protected], [email protected], [email protected]`
9+
10+
SUBJECT: `[Security Advisory] $CVE: $SUMMARY`
11+
12+
_A separate email should be sent for `[email protected]`, with `[kubernetes]` in the subject:_
13+
14+
TO: `[email protected]`
15+
16+
SUBJECT: `[kubernetes] $CVE: $SUMMARY`
17+
18+
_A separate email should be sent to the forum from the `[email protected]` Google group and cc `[email protected]`:_
19+
20+
TO: `[email protected]`
21+
cc: `[email protected]`
22+
23+
SUBJECT: `[Security Advisory] $CVE: $SUMMARY`
24+
25+
_See [Fix disclosure process](security-release-process.md#fix-disclosure-process) for additional places the announcement should be posted._
26+
27+
---
28+
29+
Hello Kubernetes Community,
30+
31+
A security issue was discovered in Kubernetes where $ACTOR may be able to $DO_SOMETHING.
32+
33+
This issue has been rated **$SEVERITY** (link to CVSS calculator https://www.first.org/cvss/calculator/3.1) (optional: $SCORE), and assigned **$CVE_NUMBER**
34+
35+
### Am I vulnerable?
36+
37+
_How to determine if a cluster is impacted. Include:_
38+
- _Vulnerable configuration details_
39+
- _Commands that indicate whether a component, version or configuration is used_
40+
41+
#### Affected Versions
42+
43+
- $COMPONENT $VERSION_RANGE_1
44+
- $COMPONENT $VERSION_RANGE_2 ...
45+
- ...
46+
47+
### How do I mitigate this vulnerability?
48+
49+
_(If additional steps required after upgrade)_
50+
**ACTION REQUIRED:** The following steps must be taken to mitigate this vulnerability: ...
51+
52+
_(If possible):_ Prior to upgrading, this vulnerability can be mitigated by ...
53+
54+
#### Fixed Versions
55+
56+
- $COMPONENT $VERSION
57+
- $COMPONENT $VERSION
58+
- ...
59+
60+
_(If fix has side effects)_ **Fix impact:** details of impact.
61+
62+
To upgrade, refer to the documentation: ... ($COMPONENT upgrade documentation)
63+
64+
_For core Kubernetes:_ https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/
65+
66+
### Detection
67+
68+
_How can exploitation of this vulnerability be detected?_
69+
70+
If you find evidence that this vulnerability has been exploited, please contact [email protected]
71+
72+
#### Additional Details
73+
74+
See the GitHub issue for more details: $GITHUBISSUEURL
75+
76+
#### Acknowledgements
77+
78+
This vulnerability was reported by $REPORTER.
79+
80+
_(optional):_ The issue was fixed and coordinated by $FIXTEAM and $RELEASE_MANAGERS.
81+
82+
Thank You,
83+
84+
$PERSON on behalf of the Kubernetes Security Response Committee

‎sig-security-tooling/src/templates/issue.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
_Use this issue template for filling out CVE placeholder issues._
2+
3+
TITLE: `CVE-####-######: $SUMMARY`
4+
5+
---
6+
7+
<!-- Copy URL after # as the link text -->
8+
CVSS Rating: [CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
9+
10+
_Description of vulnerability_
11+
12+
<!-- Copy these sections from the announcement email -->
13+
14+
### Am I vulnerable?
15+
16+
_How to determine if a cluster is impacted. Include:_
17+
- _Vulnerable configuration details_
18+
- _Commands that indicate whether a component, version or configuration is used_
19+
20+
#### Affected Versions
21+
22+
- $COMPONENT $VERSION_RANGE_1
23+
- $COMPONENT $VERSION_RANGE_2 ...
24+
- ...
25+
26+
### How do I mitigate this vulnerability?
27+
28+
_(If additional steps required after upgrade)_
29+
**ACTION REQUIRED:** The following steps must be taken to mitigate this
30+
vulnerability: ...
31+
32+
_(If possible):_ Prior to upgrading, this vulnerability can be mitigated by ...
33+
34+
#### Fixed Versions
35+
36+
<!-- Add links to PRs & main/master branch -->
37+
- $COMPONENT main/master - fixed by #12345678
38+
- ...
39+
40+
_(If fix has side effects)_ **Fix impact:** details of impact.
41+
42+
To upgrade, refer to the documentation: ... ($COMPONENT upgrade documentation)
43+
44+
_For core Kubernetes:_ https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade
45+
46+
### Detection
47+
48+
_How can exploitation of this vulnerability be detected?_
49+
50+
If you find evidence that this vulnerability has been exploited, please contact [email protected]
51+
52+
## Additional Details
53+
54+
_Optional details:_
55+
- Vulnerability background
56+
- Technical explanation of vulnerability and/or fix
57+
- Reproduction steps (avoid disclosing unnecessary details)
58+
59+
#### Acknowledgements
60+
61+
This vulnerability was reported by $REPORTER.
62+
63+
_(optional):_ The issue was fixed and coordinated by $FIXTEAM and $RELEASE_MANAGERS.
64+
65+
<!-- labels -->
66+
/area security
67+
/kind bug
68+
/committee security-response
69+
/label official-cve-feed
70+
/sig $RELEVANT_SIGS
71+
/area $IMPACTED_COMPONENTS

‎sig-security-tooling/src/templates/placeholder-issue.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
_Use this issue template for filing CVE placeholder issues._
2+
3+
TITLE: PLACEHOLDER ISSUE
4+
5+
---
6+
7+
/triage accepted
8+
/lifecycle frozen
9+
/area security
10+
/kind bug
11+
/committee security-response

‎sig-security-tooling/src/templates/slack.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
_Use this slack message template for publicly disclosing security vulnerabilities on slack._
2+
3+
_This message should be posted to the `#announcements` channel, which requires special permissions._
4+
5+
---
6+
7+
The Security Response Committee has posted a security advisory for $COMPONENT that $SUMMARY. This
8+
issue has been rated **$SEVERITY** and assigned **$CVE**. Please see $ISSUE for more details.
9+
10+
---
11+
12+
_Example_
13+
14+
The Security Response Committee has posted a security advisory for the kube-apiserver that could
15+
allow node updates to bypass a Validating Admission Webhook. This issue has been rated **Medium**
16+
and assigned **CVE-2021-25735**. Please see https://github.com/kubernetes/kubernetes/issues/100096
17+
for more details.

‎sig-security-tooling/srctl/.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
CVE*
1+
CVE*

0 commit comments

Comments
 (0)