vulnerability:managed

This tag is part of the vulnerability-classification system for vulnerability reporting and tracking across project deliverables. vulnerability:managed indicates that a deliverable’s vulnerability report reception and disclosure are handled directly by the OpenStack Vulnerability Management team (VMT).

Application to current deliverables

Rationale

The VMT is building out automation and reporting for vulnerability management processes in order to better accommodate the rapid growth of the OpenStack ecosystem. In an order to scale availability of its processes beyond its current charter and capacity, a formal acknowledgement of the list of project deliverables directly handled by the VMT (rather than managed independently by individual project teams) is best maintained through application of a governance-related tag.

Requirements

  1. Since the vulnerability:managed governance tag applies to deliverables, all repos within a given deliverable must meet the qualifying criteria. This means that if some repos in a deliverable are in good enough shape to qualify, their vulnerability management could be held back by other repos in the same deliverable. It might be argued that perhaps this makes them separate deliverables, in which case the governance reference documentation should get an update to reflect that first.

  2. The deliverable must have a dedicated point of contact for security issues (which could be shared by multiple deliverables in a given project-team if needed), so that the VMT can engage them to triage reports of potential vulnerabilities. Deliverables with more than five core reviewers should (so as to limit the unnecessary exposure of private reports) settle on a subset of these to act as security core reviewers whose responsibility it is to be able to confirm whether a bug report is accurate/applicable or at least know other subject matter experts they can in turn subscribe to perform those activities in a timely manner. They should also be able to review and provide pre-approval of patches attached to private bugs, which is why at least a majority are expected to be core reviewers for the deliverable. These should be members of a group contact (for example a <something>-coresec team) in the deliverable’s defect tracker so that the VMT can easily subscribe them to new bugs.

  3. The PTL for the deliverable should agree to act as (or delegate) a vulnerability management liaison, serving as a point of escalation for the VMT in situations where severe or lingering vulnerability reports are failing to gain traction toward timely and thorough resolution.

  4. The defect tracker for the repos within the deliverable should be configured to initially only provide access for the VMT to privately-reported vulnerabilities. It is the responsibility of the VMT to determine whether suspected vulnerabilities are reported against the correct deliverable and redirect them when possible, since reporters are often unfamiliar with our project structure and may choose incorrectly. It implies some loss of control for the project team over initial triage of bugs reported privately as suspected vulnerabilities, but in some cases helps reduce the number of people who have knowledge of them prior to public disclosure.

  5. Projects are encouraged to undertake a review, audit, or threat analysis of the deliverable in order to proactively identify likely security weaknesses. In the event the project team performs it, the results should ideally also be validated by a third party (which could just be other members of the community not involved directly in that project). If possible, the results should be proposed to the openstack/security-analysis repository in Gerrit and reviewed or refined there. Refreshing the analysis immediately following each major release is suggested, but an outdated analysis is still more useful than none at all. This is a recommendation in order to keep the VMT’s workload to a necessary minimum, but is not a requirement for adding the tag.

  6. All repos for the deliverable covered should have automated testing for important features. Tests need to be feasible for the VMT and security reviewers to run locally while evaluating patches under embargo, and must also run within the context of OpenStack’s official continuous integration infrastructure. This helps reduce the risk of approved security fixes creating new bugs when rushed through public code review at the time of disclosure, and also decreases the chance of creating additional work for the VMT issuing errata later.

  7. The VMT will not track or issue advisories for external software components. Only source code provided by official OpenStack project teams is eligible for support from the VMT. For example, base operating system components included in a server/container image or libraries vendored into compiled binary artifacts are not within the VMT’s scope.

  8. Deliverables must tag releases to qualify for VMT oversight. Vulnerabilities warrant advisories if they appear in official releases or on supported stable branches. Vulnerabilities only present in master since the last release, or only on branches under extended maintenance, will not have their disclosure coordinated by the VMT. Pre-releases, release candidates and milestones are not considered official releases for the purpose of this policy.

  9. Embargoes for privately-reported vulnerabilities shall not last more than 90 days, except under unusual circumstances. Following the embargo expiration, reports will be publicly visible regardless of whether an advisory has been issued.

Tag application process

Proposals to add or remove this tag must be reviewed by the VMT prior to final approval by the Technical Committee.

Deprecation

The vulnerability:managed tag should only be removed from deliverables under extreme circumstances, when the VMT is no longer able to adequately handle these vulnerabilities. Care should be taken to only discontinue vulnerability management for future non-patch releases, while continuing to handle vulnerabilities on already existing stable release branches if at all possible until such time as they reach extended maintenance or end-of-life.