mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
SECURITY: migrate policy to web site, update content (#5094)
This commit migrates the security policy to the OPA website. Also, it is deliberately not part of the versioned docs; we don't want anyone to find old information when it's important to get up-to-date information. Fixes #4272. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This commit is contained in:
Stephan Renatus
+4
-259
@@ -1,260 +1,5 @@
|
||||
# Security Release Process
|
||||
# Security Policy
|
||||
|
||||
The Open Policy Agent (OPA) community has adopted this security disclosures and
|
||||
response policy to ensure we responsibly handle critical issues.
|
||||
|
||||
## Product Security Team (PST)
|
||||
|
||||
Security vulnerabilities should be handled quickly and sometimes privately. The primary goal of this
|
||||
process is to reduce the total time users are vulnerable to publicly known exploits.
|
||||
|
||||
The Product Security Team (PST) is responsible for organizing the entire response including internal
|
||||
communication and external disclosure but will need help from relevant developers to successfully
|
||||
run this process.
|
||||
|
||||
The initial Product Security Team will consist of all [maintainers](MAINTAINERS.md) in the private
|
||||
[open-policy-agent-security](https://groups.google.com/forum/#!forum/open-policy-agent-security) list. In the future we may
|
||||
decide to have a subset of maintainers work on security response given that this process is time
|
||||
consuming.
|
||||
|
||||
## Disclosures
|
||||
|
||||
### Private Disclosure Processes
|
||||
|
||||
The OPA community asks that all suspected vulnerabilities be privately and responsibly disclosed
|
||||
via the [reporting policy](README.md#reporting-security-vulnerabilities).
|
||||
|
||||
### Public Disclosure Processes
|
||||
|
||||
If you know of a publicly disclosed security vulnerability please IMMEDIATELY email
|
||||
[open-policy-agent-security](https://groups.google.com/forum/#!forum/open-policy-agent-security) to inform the Product
|
||||
Security Team (PST) about the vulnerability so they may start the patch, release, and communication
|
||||
process.
|
||||
|
||||
If possible the PST will ask the person making the public report if the issue can be handled via a
|
||||
private disclosure process (for example if the full exploit details have not yet been published). If
|
||||
the reporter denies the request for private disclosure, the PST will move swiftly with the fix and
|
||||
release process. In extreme cases GitHub can be asked to delete the issue but this generally isn't
|
||||
necessary and is unlikely to make a public disclosure less damaging.
|
||||
|
||||
## Patch, Release, and Public Communication
|
||||
|
||||
For each vulnerability a member of the PST will volunteer to lead coordination with the "Fix Team"
|
||||
and is responsible for sending disclosure emails to the rest of the community. This lead will be
|
||||
referred to as the "Fix Lead."
|
||||
|
||||
The role of Fix Lead should rotate round-robin across the PST.
|
||||
|
||||
Note that given the current size of the OPA community it is likely that the PST is the same as
|
||||
the "Fix team." (I.e., all maintainers). The PST may decide to bring in additional contributors
|
||||
for added expertise depending on the area of the code that contains the vulnerability.
|
||||
|
||||
All of the timelines below are suggestions and assume a private disclosure. The Fix Lead drives the
|
||||
schedule using their best judgment based on severity and development time. If the Fix Lead is
|
||||
dealing with a public disclosure all timelines become ASAP (assuming the vulnerability has a CVSS
|
||||
score >= 4; see below). If the fix relies on another upstream project's disclosure timeline, that
|
||||
will adjust the process as well. We will work with the upstream project to fit their timeline and
|
||||
best protect our users.
|
||||
|
||||
### Fix Team Organization
|
||||
|
||||
These steps should be completed within the first 24 hours of disclosure.
|
||||
|
||||
- The Fix Lead will work quickly to identify relevant engineers from the affected projects and
|
||||
packages and CC those engineers into the disclosure thread. These selected developers are the Fix
|
||||
Team.
|
||||
- The Fix Lead will get the Fix Team access to private security repos to develop the fix.
|
||||
|
||||
### Fix Development Process
|
||||
|
||||
These steps should be completed within the 1-7 days of Disclosure.
|
||||
|
||||
- The Fix Lead and the Fix Team will create a
|
||||
[CVSS](https://www.first.org/cvss/specification-document) using the [CVSS
|
||||
Calculator](https://www.first.org/cvss/calculator/3.0). The Fix Lead makes the final call on the
|
||||
calculated CVSS; it is better to move quickly than make the CVSS perfect.
|
||||
- The Fix Team will notify the Fix Lead that work on the fix branch is complete once there are LGTMs
|
||||
on all commits in the private repo from one or more maintainers.
|
||||
|
||||
If the CVSS score is under 4.0 ([a low severity
|
||||
score](https://www.first.org/cvss/specification-document#i5)) the Fix Team can decide to slow the
|
||||
release process down in the face of holidays, developer bandwidth, etc. These decisions must be
|
||||
discussed on the open-policy-agent-security mailing list.
|
||||
|
||||
### Fix Disclosure Process
|
||||
|
||||
With the fix development underway, the Fix Lead needs to come up with an overall communication plan
|
||||
for the wider community. This Disclosure process should begin after the Fix Team has developed a Fix
|
||||
or mitigation so that a realistic timeline can be communicated to users.
|
||||
|
||||
**Disclosure of Forthcoming Fix to Users** (Completed within 1-7 days of Disclosure)
|
||||
|
||||
- The Fix Lead will email [open-policy-agent-announce@googlegroups.com](https://groups.google.com/forum/#!forum/open-policy-agent-announce)
|
||||
informing users that a security vulnerability has been disclosed and that a fix will be made
|
||||
available at YYYY-MM-DD HH:MM UTC in the future via this list. This time is the Release Date.
|
||||
- The Fix Lead will include any mitigating steps users can take until a fix is available.
|
||||
|
||||
The communication to users should be actionable. They should know when to block time to apply
|
||||
patches, understand exact mitigation steps, etc.
|
||||
|
||||
**Optional Fix Disclosure to Private Distributors List** (Completed within 1-14 days of Disclosure):
|
||||
|
||||
- The Fix Lead will make a determination with the help of the Fix Team if an issue is critical enough
|
||||
to require early disclosure to distributors. Generally this Private Distributor Disclosure process
|
||||
should be reserved for remotely exploitable or privilege escalation issues. Otherwise, this
|
||||
process can be skipped.
|
||||
- The Fix Lead will email the patches to open-policy-agent-distributors-announce@googlegroups.com so
|
||||
distributors can prepare builds to be available to users on the day of the issue's announcement.
|
||||
Distributors should read about the [Private Distributors List](#private-distributors-list) to find
|
||||
out the requirements for being added to this list.
|
||||
- **What if a vendor breaks embargo?** The PST will assess the damage. The Fix Lead will make the
|
||||
call to release earlier or continue with the plan. When in doubt push forward and go public ASAP.
|
||||
|
||||
**Fix Release Day** (Completed within 1-21 days of Disclosure)
|
||||
|
||||
- The maintainers will create a new patch release branch from the latest patch release tag + the fix
|
||||
from the security branch. As a practical example if v1.5.3 is the latest patch release in opa.git
|
||||
a new branch will be created called v1.5.4 which includes only patches required to fix the issue.
|
||||
- The Fix Lead will cherry-pick the patches onto the main branch and all relevant release branches.
|
||||
The Fix Team will LGTM and merge. Maintainers will merge these PRs as quickly as possible. Changes
|
||||
shouldn't be made to the commits even for a typo in the CHANGELOG as this will change the git sha
|
||||
of the commits leading to confusion and potentially conflicts as the fix is cherry-picked around
|
||||
branches.
|
||||
- The Fix Lead will request a CVE from [DWF](https://github.com/distributedweaknessfiling/DWF-Documentation)
|
||||
and include the CVSS and release details.
|
||||
- The Fix Lead will email open-policy-agent[-announce]@googlegroups.com now that everything is public
|
||||
announcing the new releases, the CVE number, and the relevant merged PRs to get wide distribution
|
||||
and user action. As much as possible this email should be actionable and include links on how to apply
|
||||
the fix to user's environments; this can include links to external distributor documentation.
|
||||
- The Fix Lead will remove the Fix Team from the private security repo.
|
||||
|
||||
### Retrospective
|
||||
|
||||
These steps should be completed 1-3 days after the Release Date. The retrospective process
|
||||
[should be blameless](https://landing.google.com/sre/book/chapters/postmortem-culture.html).
|
||||
|
||||
- The Fix Lead will send a retrospective of the process to open-policy-agent@googlegroups.com including
|
||||
details on everyone involved, the timeline of the process, links to relevant PRs that introduced
|
||||
the issue, if relevant, and any critiques of the response and release process.
|
||||
- Maintainers and Fix Team are also encouraged to send their own feedback on the process to
|
||||
open-policy-agent@googlegroups.com. Honest critique is the only way we are going to get good at this as a
|
||||
community.
|
||||
|
||||
## Private Distributors List
|
||||
|
||||
This list is intended to be used primarily to provide actionable information to
|
||||
multiple distribution vendors at once. This list is not intended for
|
||||
individuals to find out about security issues.
|
||||
|
||||
### Embargo Policy
|
||||
|
||||
The information members receive on open-policy-agent-distributors-announce must not be made public, shared, nor
|
||||
even hinted at anywhere beyond the need-to-know within your specific team except with the list's
|
||||
explicit approval. This holds true until the public disclosure date/time that was agreed upon by the
|
||||
list. Members of the list and others may not use the information for anything other than getting the
|
||||
issue fixed for your respective distribution's users.
|
||||
|
||||
Before any information from the list is shared with respective members of your team required to fix
|
||||
said issue, they must agree to the same terms and only find out information on a need-to-know basis.
|
||||
|
||||
In the unfortunate event you share the information beyond what is allowed by this policy, you _must_
|
||||
urgently inform the open-policy-agent-security@googlegroups.com mailing list of exactly what information leaked
|
||||
and to whom. A retrospective will take place after the leak so we can assess how to not make the
|
||||
same mistake in the future.
|
||||
|
||||
If you continue to leak information and break the policy outlined here, you will be removed from the
|
||||
list.
|
||||
|
||||
### Contributing Back
|
||||
|
||||
This is a team effort. As a member of the list you must carry some water. This
|
||||
could be in the form of the following:
|
||||
|
||||
**Technical**
|
||||
|
||||
- Review and/or test the proposed patches and point out potential issues with
|
||||
them (such as incomplete fixes for the originally reported issues, additional
|
||||
issues you might notice, and newly introduced bugs), and inform the list of the
|
||||
work done even if no issues were encountered.
|
||||
|
||||
**Administrative**
|
||||
|
||||
- Help draft emails to the public disclosure mailing list.
|
||||
- Help with release notes.
|
||||
|
||||
### Membership Criteria
|
||||
|
||||
To be eligible for the open-policy-agent-distributors-announce mailing list, your
|
||||
distribution should:
|
||||
|
||||
1. Be an actively maintained distribution of OPA components OR offer OPA as a publicly
|
||||
available service in which the product clearly states that it is built on top of OPA. E.g.,
|
||||
"SuperAwesomeLinuxDistro" which offers OPA pre-built packages OR
|
||||
"SuperAwesomeCloudProvider's OPA as a Service (EaaS)". A cloud service that uses OPA for a
|
||||
product but does not publicly say they are using OPA does not qualify.
|
||||
2. Have a user base not limited to your own organization.
|
||||
3. Have a publicly verifiable track record up to present day of fixing security
|
||||
issues.
|
||||
4. Not be a downstream or rebuild of another distribution.
|
||||
5. Be a participant and active contributor in the community.
|
||||
6. Accept the [Embargo Policy](#embargo-policy) that is outlined above.
|
||||
7. Be willing to [contribute back](#contributing-back) as outlined above.
|
||||
8. Have someone already on the list vouch for the person requesting membership
|
||||
on behalf of your distribution.
|
||||
|
||||
### Requesting to Join
|
||||
|
||||
New membership requests are sent to open-policy-agent-security@googlegroups.com.
|
||||
|
||||
In the body of your request please specify how you qualify and fulfill each
|
||||
criterion listed in [Membership Criteria](#membership-criteria).
|
||||
|
||||
Here is a pseudo example:
|
||||
|
||||
```
|
||||
To: open-policy-agent-security@googlegroups.com
|
||||
Subject: Seven-Corp Membership to open-policy-agent-distributors-announce
|
||||
|
||||
Below are each criterion and why I think we, Seven-Corp, qualify.
|
||||
|
||||
> 1. Be an actively maintained distribution of OPA components OR offer OPA as a publicly
|
||||
available service in which the product clearly states that it is built on top of OPA.
|
||||
|
||||
We distribute the "Seven" distribution of OPA [link]. We have been doing
|
||||
this since 1999 before proxies were even cool.
|
||||
|
||||
> 2. Have a user base not limited to your own organization.
|
||||
|
||||
Our user base spans of the extensive "Seven" community. We have a slack and
|
||||
GitHub repos and mailing lists where the community hangs out. [links]
|
||||
|
||||
> 3. Have a publicly verifiable track record up to present day of fixing security
|
||||
issues.
|
||||
|
||||
We announce on our blog all upstream patches we apply to "Seven." [link to blog
|
||||
posts]
|
||||
|
||||
> 4. Not be a downstream or rebuild of another distribution.
|
||||
|
||||
This does not apply, "Seven" is a unique snowflake distribution.
|
||||
|
||||
> 5. Be a participant and active contributor in the community.
|
||||
|
||||
Our members, Acidburn, Cereal, and ZeroCool are outstanding members and are well
|
||||
known throughout the OPA community. Especially for their contributions
|
||||
in hacking the Gibson.
|
||||
|
||||
> 6. Accept the Embargo Policy that is outlined above.
|
||||
|
||||
We accept.
|
||||
|
||||
> 7. Be willing to contribute back as outlined above.
|
||||
|
||||
We are definitely willing to help!
|
||||
|
||||
> 8. Have someone already on the list vouch for the person requesting membership
|
||||
on behalf of your distribution.
|
||||
|
||||
CrashOverride will vouch for Acidburn joining the list on behalf of the "Seven"
|
||||
distribution.
|
||||
```
|
||||
Please refer to the [OPA Security Policy](https://openpolicyagent.org/security)
|
||||
for details on how to report security issues, our disclosure policy, and how to
|
||||
receive notifications about security issues.
|
||||
@@ -38,27 +38,14 @@
|
||||
</ul>
|
||||
|
||||
<ul class="navbar-nav">
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./docs/{{ $latest }}/">Documentation </a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./docs/{{ $latest }}/#running-opa">Download </a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./docs/{{ $latest }}/ecosystem/">Ecosystem </a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./support">Support</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./community">Community</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="https://play.openpolicyagent.org/">Playground</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a>
|
||||
</li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/{{ $latest }}/">Docs</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/{{ $latest }}/#running-opa">Download</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/{{ $latest }}/ecosystem/">Ecosystem</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./security">Security</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./support">Support</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./community">Community</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="https://play.openpolicyagent.org/">Play</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a></li>
|
||||
<li class="nav-item social-nav-item">
|
||||
<a class="nav-link social-icon-link" href="https://twitter.com/openpolicyagent">
|
||||
<img src="./img/twitter-icon.png" alt="Twitter">
|
||||
|
||||
@@ -37,27 +37,14 @@
|
||||
</ul>
|
||||
|
||||
<ul class="navbar-nav">
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./docs/">Documentation</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./docs/#running-opa">Download</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./docs/latest/ecosystem/">Ecosystem</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./support">Support</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./community">Community</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="https://play.openpolicyagent.org/">Playground</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a>
|
||||
</li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/">Docs</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/#running-opa">Download</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/latest/ecosystem/">Ecosystem</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./security">Security</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./support">Support</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./community">Community</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="https://play.openpolicyagent.org/">Play</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a></li>
|
||||
<li class="nav-item social-nav-item">
|
||||
<a class="nav-link social-icon-link" href="https://twitter.com/openpolicyagent">
|
||||
<img src="./img/twitter-icon.png" alt="Twitter">
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
ol {
|
||||
list-style: roman;
|
||||
}
|
||||
|
||||
ul {
|
||||
list-style: square;
|
||||
}
|
||||
|
||||
section {
|
||||
padding-bottom: 200px;
|
||||
}
|
||||
@@ -0,0 +1,156 @@
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
|
||||
<head>
|
||||
<!-- Required meta tags -->
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport"
|
||||
content="width=device-width, initial-scale=1, shrink-to-fit=no">
|
||||
|
||||
<!-- Bootstrap CSS -->
|
||||
<link rel="stylesheet" href="css/bootstrap.min.css">
|
||||
|
||||
<title>Open Policy Agent | Security Policy</title>
|
||||
<link rel="stylesheet" href="css/home.css">
|
||||
<link rel="stylesheet" href="css/community.css">
|
||||
<link rel="stylesheet" href="css/security.css">
|
||||
<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.15.4/css/all.css">
|
||||
</head>
|
||||
|
||||
<body data-spy="scroll" data-target=".navbar" data-offset="90">
|
||||
|
||||
|
||||
<div class="support-bg">
|
||||
<div id="navigation">
|
||||
<nav class="navbar navbar-expand-lg navbar-dark bg-transparent">
|
||||
<div class="container">
|
||||
|
||||
<a class="navbar-brand" href="/" aria-label="Open Policy Agent home"><img
|
||||
title="OPA logo" src="./img/logo-white.png" class="img-fluid"></a>
|
||||
<button class="navbar-toggler navbar-toggler-right collapsed"
|
||||
type="button" data-toggle="collapse"
|
||||
data-target="#navb" aria-expanded="false">
|
||||
<span class="navbar-toggler-icon"></span>
|
||||
</button>
|
||||
|
||||
<div class="navbar-collapse collapse" id="navb">
|
||||
<ul class="navbar-nav mr-auto">
|
||||
</ul>
|
||||
|
||||
<ul class="navbar-nav">
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/">Docs</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/#running-opa">Download</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/latest/ecosystem/">Ecosystem</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./security">Security</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./support">Support</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./community">Community</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="https://play.openpolicyagent.org/">Play</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a></li>
|
||||
<li class="nav-item social-nav-item">
|
||||
<a class="nav-link social-icon-link" href="https://twitter.com/openpolicyagent">
|
||||
<img src="./img/twitter-icon.png" alt="Twitter">
|
||||
<div class="nav-link social-icon-title">Twitter</div>
|
||||
</a>
|
||||
</li>
|
||||
<li class="nav-item social-nav-item">
|
||||
<a class="nav-link social-icon-link" href="https://slack.openpolicyagent.org/">
|
||||
<img src="./img/slack-icon.png" alt="Slack">
|
||||
<div class="nav-link social-icon-title">Slack</div>
|
||||
</a>
|
||||
</li>
|
||||
<li class="nav-item social-nav-item">
|
||||
<a class="nav-link social-icon-link" href="https://github.com/open-policy-agent/opa">
|
||||
<img src="./img/github-icon.png" alt="GitHub">
|
||||
<div class="social-icon-title">GitHub</div>
|
||||
</a>
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</nav>
|
||||
</div>
|
||||
|
||||
<main class="support-content">
|
||||
<section id="homebackground">
|
||||
<h1 class="banner-content text-center">
|
||||
Security Policy
|
||||
</h1>
|
||||
<div class="banner-subcontent">
|
||||
The Open Policy Agent (OPA) community has adopted this security disclosures and response policy to ensure we responsibly handle critical issues.
|
||||
</div>
|
||||
<h2 class="divider line glow">Reporting a Security Bug</h2>
|
||||
<div class="banner-subcontent">
|
||||
<ul>
|
||||
<li>If you think you have found a security issue in an OPA project, please send an
|
||||
email to <a href="mailto:open-policy-agent-security@googlegroups.com">open-policy-agent-security</a>.
|
||||
This list is delivered to a small security team. We will then acknowledge receipt
|
||||
of your report and prioritize initial analysis of severity.</li>
|
||||
|
||||
<li>After the initial reply to your report, the security team will endeavor to keep you informed
|
||||
of the progress being made towards a fix and full announcement, and may ask for additional
|
||||
information or guidance surrounding the reported issue.</p>
|
||||
|
||||
<li>If you have not received a reply to your report within two days, please reach out on our
|
||||
<a href="https://slack.openpolicyagent.org/">Slack</a>
|
||||
by posting a message in the <code>#contributors</code> channel.</li>
|
||||
|
||||
<li>Note that the <code>#conributors</code> channel is public, so please don't discuss details of your
|
||||
issue there. Instead, simply say that you're trying to get a hold of someone from the security team.</li>
|
||||
</ul>
|
||||
</div>
|
||||
<h2 class="divider line glow">Disclosure Policy</h2>
|
||||
<div class="banner-subcontent">
|
||||
<ol>
|
||||
<li>The security report is received and is assigned a primary handler.
|
||||
This person will coordinate the fix and release process.
|
||||
The problem is confirmed and a list of all affected versions is determined.
|
||||
Code is audited to find any potential similar problems.
|
||||
Fixes are prepared for all releases which are still under maintenance.
|
||||
These fixes are not committed to the public repository but rather held locally or in a private fork pending the announcement.</li>
|
||||
|
||||
<li>A suggested embargo date for this vulnerability is chosen and a CVE
|
||||
(Common Vulnerabilities and Exposures (CVE®)) is requested for the vulnerability,
|
||||
through the GitHub Advisory database.</li>
|
||||
|
||||
<li>A prenotification may be published on the security announcements channels listed below,
|
||||
providing information about affected projects, severity, and the embargo date.</li>
|
||||
|
||||
<li>On the embargo date, the announcement is published.
|
||||
The changes are pushed to the public repository and new builds are deployed.
|
||||
</li>
|
||||
|
||||
<li>Typically the embargo date will be set 72 hours from the time the CVE is issued.
|
||||
However, this may vary depending on the severity of the bug or difficulty in applying a fix.</li>
|
||||
|
||||
<li>This process can take some time, especially when coordination is required with maintainers of
|
||||
other projects. Every effort will be made to handle the bug in as timely a manner as possible;
|
||||
however, it’s important that we follow the release process above to ensure that the disclosure
|
||||
is handled in a consistent manner.</li>
|
||||
<ol>
|
||||
</div>
|
||||
<h2 class="divider line glow">Receiving Security Updates</h2>
|
||||
<div class="banner-subcontent">
|
||||
<ul>
|
||||
<li><a href="https://github.com/open-policy-agent/opa/security/advisories">Security Advistories for OPA</a></li>
|
||||
<li><a href="https://github.com/open-policy-agent/community/discussions/categories/announcements">GitHub Discussions</a> Announcements</li>
|
||||
<li><a href="https://slack.openpolicyagent.org/">Slack</a> <code>#annoucements</code> channel</li>
|
||||
<li><a href="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&isCpeNameSearch=false&cpe_vendor=cpe%3A%2F%3Aopenpolicyagent&cpe_product=cpe%3A%2F%3Aopenpolicyagent%3Aopen_policy_agent">NIST Vulnerability Data Base: Search Results for OPA</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
</section>
|
||||
</main>
|
||||
</div>
|
||||
|
||||
<!-- jQuery first, then Popper.js, then Bootstrap JS -->
|
||||
<script src="https://code.jquery.com/jquery-3.3.1.slim.min.js"
|
||||
integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"
|
||||
crossorigin="anonymous"></script>
|
||||
<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js"
|
||||
integrity="sha384-UO2eT0CpHqdSJQ6hJty5KVphtPhzWj9WO1clHTMGa3JDZwrnQq4sF86dIHNDz0W1"
|
||||
crossorigin="anonymous"></script>
|
||||
<script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js"
|
||||
integrity="sha384-JjSmVgyd0p3pXB1rRibZUAYoIIy6OrQ6VrjIEaFf/nJGzIxFDsf4x0xIM+B07jRM"
|
||||
crossorigin="anonymous"></script>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@@ -36,28 +36,14 @@
|
||||
</ul>
|
||||
|
||||
<ul class="navbar-nav">
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./docs/latest/">Documentation </a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./docs/latest/#running-opa">Download </a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link"
|
||||
href="./docs/latest/ecosystem/">Ecosystem </a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./support">Support</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="./community">Community</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="https://play.openpolicyagent.org/">Playground</a>
|
||||
</li>
|
||||
<li class="nav-item">
|
||||
<a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a>
|
||||
</li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/">Docs</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/#running-opa">Download</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./docs/latest/ecosystem/">Ecosystem</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./security">Security</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./support">Support</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="./community">Community</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="https://play.openpolicyagent.org/">Play</a></li>
|
||||
<li class="nav-item"><a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a></li>
|
||||
<li class="nav-item social-nav-item">
|
||||
<a class="nav-link social-icon-link" href="https://twitter.com/openpolicyagent">
|
||||
<img src="./img/twitter-icon.png" alt="Twitter">
|
||||
|
||||
Reference in New Issue
Block a user