Meta tags:

Headings (most frequently used words):

description, process, ossa, reception, patch, impact, embargo, issues, vulnerability, management, disclosure, review, cve, downstream, stakeholders, private, openstack, supported, versions, report, taxonomy, task, status, extent, of, templates, development, draft, send, request, get, assigned, embargoed, open, bug, push, publish, all, patches, merged, abnormal, termination, exceptions, reminder, incomplete, message, unconfirmed, notification, email, security, advisories, community, documentation, branding, legal, stay, in, touch, contents,

Text of the page (most frequently used words):
the (275), and (73), for (48), #openstack (43), bug (40), security (39), #vulnerability (39), this (39), description (32), cve (32), ossa (31), that (31), report (29), disclosure (26), public (25), impact (23), patches (23), project (21), you (21), not (21), embargo (20), review (20), should (20), are (20), will (18), with (18), private (17), patch (17), vmt (17), process (16), affected (15), email (14), fix (14), request (13), date (13), org (12), downstream (12), may (12), stakeholders (11), status (11), management (11), ossn (11), set (11), file (10), note (10), version (10), launchpad (10), time (10), team (10), any (10), code (10), class (10), issues (9), all (9), title (9), once (9), advisory (9), https (9), key (9), can (9), supported (8), form (8), before (8), first (8), from (8), been (8), they (8), under (7), reception (7), incomplete (7), open (7), assigned (7), versions (7), guides (7), list (7), other (7), vulnerabilities (7), distros (7), but (7), have (7), branches (7), added (7), coordinator (7), field (7), bugtask (7), type (7), message (6), reminder (6), task (6), merged (6), see (6), page (6), must (6), signed (6), subject (6), emails (6), lists (6), approved (6), use (6), name (6), proposed (6), number (6), master (6), please (6), issue (6), only (6), potential (6), has (6), days (6), fields (6), openinfra (5), documentation (5), projects (5), embargoed (5), get (5), send (5), where (5), rst (5), then (5), component (5), line (5), don (5), affected_versions (5), credit (5), using (5), linux (5), make (5), when (5), attached (5), more (5), stable (5), until (5), their (5), coordinated (5), next (5), reporter (5), core (5), reports (5), some (5), about (5), people (5), instead (5), fill (5), need (5), foundation (5), docs (4), user (4), community (4), advisories (4), notification (4), development (4), document (4), num (4), yyyy (4), generated (4), html (4), length (4), what (4), yaml (4), since (4), into (4), directly (4), submitted (4), encrypted (4), there (4), one (4), branch (4), release (4), information (4), comment (4), possible (4), well (4), publication (4), affects (4), being (4), who (4), submit (4), member (4), out (4), confirmed (4), progress (4), here (4), warranted (4), mitre (4), sent (4), check (4), legal (3), wiki (3), events (3), extent (3), taxonomy (3), publish (3), push (3), draft (3), updated (3), both (3), oss (3), openwall (3), url (3), separate (3), avoid (3), replies (3), keep (3), text (3), appropriate (3), products (3), product (3), reported (3), kilo (3), opendev (3), your (3), mailing (3), whose (3), posted (3), names (3), advance (3), fixes (3), following (3), subscribe (3), openpgp (3), pre (3), might (3), choose (3), address (3), identified (3), end (3), released (3), still (3), reviewers (3), already (3), prior (3), stakeholder (3), used (3), able (3), fixed (3), our (3), details (3), necessary (3), steps (3), invalid (3), todo (3), releases (3), does (3), subsequent (3), commit (3), messages (3), software (3), pushing (3), mail (3), initial (3), subscription (3), storyboard (3), put (3), required (3), anyone (3), clouds (3), provided (2), computing (2), license (2), stay (2), policy (2), api (2), jobs (2), news (2), blog (2), unconfirmed (2), templates (2), exceptions (2), abnormal (2), termination (2), contents (2), found (2), except (2), gpg (2), notes (2), body (2), content (2), identical (2), discuss (2), change (2), two (2), off (2), topic (2), eventually (2), require (2), thus (2), files (2), repository (2), description_content (2), reporters (2), net (2), bugs (2), optional (2), such (2), template (2), which (2), mentioned (2), above (2), sure (2), fingerprint (2), associated (2), attachment (2), sign (2), characters (2), example (2), was (2), contain (2), than (2), 2013 (2), 4183 (2), discovered (2), give (2), chance (2), reduce (2), them (2), these (2), corresponding (2), access (2), read (2), reply (2), four (2), square (2), bracket (2), lowercase (2), right (2), below (2), sender (2), notice (2), convention (2), three (2), current (2), includes (2), even (2), though (2), tagged (2), know (2), necessarily (2), also (2), 2015 (2), needs (2), after (2), like (2), action (2), deployment (2), sentence (2), included (2), along (2), risk (2), concerns (2), value (2), subscribed (2), ninety_days (2), official (2), discussion (2), provide (2), made (2), attachments (2), extend (2), past (2), currently (2), referenced (2), period (2), small (2), business (2), too (2), short (2), usually (2), final (2), over (2), lesser (2), reach (2), science (2), around (2), design (2), won (2), triaged (2), whenever (2), hardening (2), opportunity (2), production (2), without (2), complete (2), yet (2), outcome (2), classes (2), order (2), creation (2), immediately (2), tracked (2), automatically (2), point (2), again (2), select (2), covered (2), bottom (2), published (2), link (2), update (2), gerrit (2), fast (2), assignment (2), received (2), requesting (2), top (2), correct (2), confirmation (2), button (2), attempt (2), attack (2), relevant (2), drop (2), down (2), cases (2), section (2), match (2), cwe (2), checkbox (2), box (2), generally (2), managed (2), input (2), ensure (2), full (2), approval (2), through (2), including (2), switched (2), later (2), intentionally (2), apply (2), interested (2), question (2), system (2), teams (2), follow (2), add (2), members (2), fixing (2), manner (2), membership (2), summit (2), powered, rackspace, cloud, apache, touch, cla, privacy, trademark, logos, guidelines, branding, getting, started, manuals, contribute, companies, groups, 简体中文, simplified, chinese, türkçe, türkiye, português, portuguese, 한국어, korean, 日本語, japanese, italiano, italian, bahasa, indonesia, indonesian, français, french, deutsch, german, languages, contributor, operations, administration, configuration, install, error, otherwise, noted, licensed, documents, creative, commons, attribution, last, 2026, xxx, always, xxxx, com, announce, view, gate, output, browse, rendered, alter, insert, path, extension, _sources, another, implication, determined, pasting, therefore, want, wrapping, extracted, inserted, restructured, include, markup, words, overdo, examples, affiliation, credit_affiliation, links, reviews, master_review, juno, stable_review, cross, requirements, post, expect, arrive, place, independently, located, requirement, alphanumeric, dot, minus, underscore, allowed, within, character, mind, renaming, something, unique, descriptive, written, obtained, rename, ideally, involved, applies, grizzly, havana, iso, 8601, style, warning, coordinate, window, treat, confidential, unless, flaw, 1500utc, original, username, vmt_coordinator_name, left, space, automation, reject, patchlevel, semver, rules, highest, given, actual, lowest, could, makes, clear, prerelease, sufficient, oldest, easily, leave, ended, reaches, life, becomes, valid, liberty, mitaka, keystone, feature, doing, actor, resulting, consequence, mode, solutions, scope, confirm, while, accepted, trivially, calculated, shell, command, earlier, beginning, d90days, treated, mention, forums, systems, trackers, individuals, same, those, aware, remain, confined, shall, think, definitely, distribution, rationale, upstream, distributions, service, offerings, negatively, spirit, ecosystem, collectively, known, warned, prepare, roll, fashion, day, kept, voluntarily, middle, ground, between, keeping, cover, long, giving, react, effective, take, much, weeks, complex, better, solved, unusual, circumstances, retain, control, findings, reason, uncomfortable, choice, terms, prevails, disclosing, increasing, step, diagram, shows, across, various, somewhere, assess, severity, obsessive, perfectionist, respecting, rule, further, taken, unclear, warrants, meaning, summary, different, meanings, due, fails, neither, nor, just, implications, strengthening, opportunities, misleading, admin, risks, dependency, considered, practical, assign, experimental, debugging, features, intended, poor, architecture, default, config, insecure, now, classification, assist, triage, especially, warrant, held, significant, disclosed, venue, terminated, switches, workflow, merge, closely, correctly, reflect, shortly, potentially, waiting, test, runs, wait, setting, ids, notify, track, approvals, because, reviewed, remind, closes, related, lines, referencing, everyone, remove, hour, preparation, available, help, maintainer, reviewer, non, committed, drafting, begins, excluding, monday, friday, holiday, periods, 1500, utc, supposed, deploy, returns, story, retitled, data, highlighted, red, navigate, away, lose, everything, typed, click, scheduled, additional, urls, references, discoverer, credits, paste, prose, omitting, redundant, suggested, vector, free, checkboxes, often, context, dependent, radio, yes, acknowledged, vendor, generate, new, identifier, matches, noinfo, enter, freeform, nothing, unknown, indicating, cna, submitting, pasted, requester, case, officially, classifications, exactly, expects, checklist, filling, grows, dynamically, traceability, obtain, communicated, larger, done, gets, nearer, validated, ptl, properly, specify, unsupported, ones, accurately, describe, mitigation, mechanisms, needed, built, brief, typically, suitable, few, followed, single, paragraph, approximately, sentences, target, audience, itself, trying, decide, whether, accompanying, happen, doesn, detail, internals, how, implemented, level, find, mean, prepares, forms, basis, eventual, communication, finally, usual, processes, suggest, updates, approve, merging, privately, developed, side, delays, encountered, stage, parties, immediate, attention, liaison, automatic, plus, deem, develop, validate, benefit, depending, tracker, situation, state, optionally, adding, tag, specifics, indexed, tables, doc, confirms, challenged, back, resolved, determination, prefix, its, indicates, adjust, create, exist, performed, either, marked, each, drive, coordinates, maintained, previous, major, addition, repositories, overseen, independent, minded, folks, dealt, timely, notified, fair, employed, employer, early, stages, limited, responsible, coordinating, progressive, log, sponsor, join, drivers, consulting, integrators, remotely, hosted, appliances, training, marketplace, supporting, organizations, superuser, magazine, marketing, resources, certified, coa, speakers, bureau, technical, committee, welcome, start, videos, gathering, survey, enterprise, containers, hpc, telecom, nfv, edge, ironic, bare, metal, users, sample, configs, map, tools, sdks, components, overview, global, search, toggle, navigation, dev416,

Text of the page (random words):
e security advisory that will be finally published an impact description is intentionally brief typically a short title suitable for an e mail subject line a few fields about the reporter project name and affected versions followed by a single paragraph approximately three or four sentences in length the target audience for our advisories and thus the impact description itself is an end user trying to decide whether they need to apply the accompanying fix and what might happen if they don t it doesn t need to go into detail about software internals or how the fix is implemented anyone interested in that level of information can find it in the bug report or change review the impact description should properly credit the reporter specify affected versions including unsupported ones and accurately describe impact and mitigation mechanisms using the impact description template below once the description is posted the openstack ossa or ossa bugtask status should be switched to review triaged note a full draft advisory is not needed at this time and will be built around the impact description later in the process when eventually required review impact description the description is validated by the reporter and the ptl send cve request to ensure full traceability we attempt to obtain a cve assignment before the issue is communicated to a larger public this is generally done as the patch gets nearer to final approval the ossa bugtask status is set to in progress and the approved impact description is submitted through mitre s cve request form openstack s security classifications don t match exactly to what mitre expects so here s a checklist for filling out the request form the form grows input fields dynamically as you fill it out at the top of the page the request type is report vulnerability request cve id the e mail address should be that of the requester generally the assigned vmt coordinator in the case of reports officially managed by the vmt for embargoed reports the coordinator s openpgp key should be pasted into the field provided in the before submitting this request box set the checkbox indicating the product is not cna covered set the checkbox that no prior cve id has been assigned in the required section select an appropriate vulnerability type using other or unknown to enter a freeform type if there is nothing relevant on the drop down this will generate a new required field for other vulnerability type where you can put a cwe identifier if you know of one that matches or cwe noinfo if you don t set the vendor to openstack set the product and version fields to match the projects and affected_versions from the impact description in the optional section set the radio button for confirmed acknowledged to yes choose an appropriate attack type in the drop down often this is context dependent for our cases check the relevant impact checkboxes if you check other a free text field will open where you can type in the impact attempt to fill in the affected component s and attack vector fields if possible paste in the suggested description from the prose of the impact description usually omitting the first sentence as it s redundant with other fields in the form put the credit details in the discoverer credits field in the references field put the bug url along with gerrit urls for patches if already public if the report is still private note this in the additional information field with some text like this report is currently under embargo and no disclosure date has been scheduled at this time at the bottom of the page fill in the security code click the submit request button if some fields contain invalid data they will be highlighted red correct these update the security code and submit request again until you get a confirmation page note if you navigate away from the page you may lose everything you have typed in get assigned cve mitre returns the assigned cve it is added to the bug see link to cve at the top right in launchpad or use a story comment in storyboard and the bug is retitled to title cve embargoed disclosure once the patches are approved and the cve is assigned a signed email with the vulnerability description is sent to the downstream stakeholders the disclosure date is set to 5 10 business days excluding monday friday and holiday periods at 1500 utc no stakeholder is supposed to deploy public patches before disclosure date once the email is sent any stakeholders who reply requesting subscription to the report may be added for non embargoed public vulnerabilities no separate downstream advance notification is sent instead the ossa bugtask is set to fix committed status once the cve assignment is received and ossa drafting begins immediately open bug push patch in preparation for this make sure you have a core reviewer and a stable maintainer available to help pushing the fix at disclosure time on the disclosure hour remove the embargo reminder on the launchpad bug open the bug to make it public launchpad will send initial notification emails to everyone who has subscribed to any of the affected projects remind the people pushing patches that they should have closes bug or related bug lines in the commit messages referencing the bug push patches to gerrit for review on master and supported stable branches fast track approvals because the patches have already been reviewed on the launchpad bug update the bug title to ossa num title mitre s cve request form should be used again at this point but instead select a request type of notify cve about a publication and fill in the coordinator s e mail address provide a link to the advisory the url to it on https security openstack org if this was an official ossa the cve ids covered and the date published once more fill in the security code at the bottom of the page and submit request publish ossa shortly after pushing the patches potentially waiting for the first test runs to complete publish the advisory to the openstack ml wait until all patches merged to supported branches before setting the ossa bugtask status to fix released all patches merged patches approved in code review do not necessarily merge immediately but should be tracked closely until they do if the bug number is correctly identified in commit messages then it will be automatically updated to reflect this as well subsequent security point releases of affected software may then be tagged if warranted abnormal embargo termination if a report is held in embargo for 90 days without a fix or significant details of the report are disclosed in a public venue the embargo is terminated by a vmt coordinator at that time and subsequent process switches to the public report workflow instead report taxonomy the vmt is now using this classification list in order to assist vulnerability report triage especially whenever a bug does not warrant an advisory for the classes whose outcome is an ossn see the ossn creation process classes outcome description class a ossa a vulnerability to be fixed in master and all supported releases class b1 ossn a vulnerability that can only be fixed in master security note for stable branches e g default config value is insecure class b2 ossn a vulnerability without a complete fix yet security note for all versions e g poor architecture design class b3 ossn a vulnerability in experimental or debugging features not intended for production use class c1 potential ossn not considered a practical vulnerability but some people might assign a cve for it class c2 potential ossn a vulnerability but not in openstack supported code e g in a dependency class d potential ossn not a vulnerability just a bug with some security implications e g strengthening opportunities misleading documentation admin only risks class e neither a vulnerability nor hardening opportunity class y vulnerability only found in development release class z when due process fails ossa task status here is a summary of the different ossa task status meanings status meaning todo incomplete it is still unclear whenever the report warrants an advisory progress confirmed the vulnerability is confirmed impact description is in progress review triaged impact description has been submitted for review merged fix released all patches have been merged invalid won t fix no further action to be taken extent of disclosure the science of vulnerability management is somewhere around being able to assess impact and severity of a report being able to design security patches being an obsessive process following perfectionist and respecting the rule of lesser disclosure lesser disclosure is about disclosing the vulnerability details to an increasing number of people over time but only to the people that are necessary to reach the next step the diagram above shows disclosure extent across the various steps of the process vulnerability reporters retain final control over the disclosure of their findings if for some reason they are uncomfortable with our process their choice of disclosure terms prevails embargo exceptions to keep the embargo period short and effective the vmt may choose to open bug reports issues that take too much time to be fixed e g more than 2 weeks or issues that require a complex patch are usually better solved in the open only under unusual circumstances should any embargo extend past 90 days downstream stakeholders openstack as an upstream project is used in a number of distributions products private and public service offerings that are negatively affected by vulnerabilities in the spirit of coordinated disclosure this ecosystem collectively known as the downstream stakeholders needs to be warned in advance to be able to prepare patches and roll them out in a coordinated fashion on disclosure day the embargo period is kept voluntarily small 5 10 business days as a middle ground between keeping the vulnerability under cover for too long and not giving a chance to downstream stakeholders to react if you re currently not a referenced stakeholder and think you should definitely be included on that email distribution list please submit an email with a rationale to member s of the vulnerability management team templates reception embargo reminder private issues this issue is being treated as a potential security risk under embargo please do not make any public mention of embargoed private security vulnerabilities before their coordinated publication by the openstack vulnerability management team in the form of an official openstack security advisory this includes discussion of the bug or associated fixes in public forums such as mailing lists code review systems and bug trackers please also avoid private disclosure to other individuals not already approved for access to this information and provide this same reminder to those who are made aware of the issue prior to publication all discussion should remain confined to this private bug report and any proposed fixes should be added to the bug as attachments this embargo shall not extend past ninety_days and will be made public by or on that date even if no fix is identified the ninety_days value should be 90 days from the date the report is accepted by the coordinator and project reviewers are subscribed it can be trivially calculated with the date i d90days shell command as mentioned earlier this embargo reminder is added at the beginning of the bug description field on the bug report reception incomplete message unconfirmed issues since this report concerns a possible security risk an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions this sentence should be added as or included in the first comment on the bug report impact description description title title reporter credit products project affects affected_versions description credit reported a vulnerability in project feature name by doing action a actor may impact resulting in consequence only project deployment mode are affected the affected_versions needs to stay valid after the fix is released for example when kilo liberty and mitaka are still security supported the affected_versions of keystone should read like this affects 2015 1 0 2015 1 5 8 0 0 8 1 1 and 9 0 0 once kilo reaches end of life that line becomes affects 8 0 0 8 1 1 and 9 0 0 if the oldest version affected is not easily identified leave it open ended affects 8 1 1 and 9 0 0 by convention the version is the next possible patchlevel release following three component semver rules so if the current highest affected version on a given branch is 8 1 0 then the affected versions includes 8 1 1 even though the next actual version tagged might well be 8 2 0 or 9 0 0 but since we don t know what the next version will necessarily be at the time of publication we choose the lowest possible version it could be this convention also makes it clear that prerelease versions may not be sufficient to address the vulnerability downstream stakeholders notification email private issues we send two separate emails to avoid off topic replies to linux distros to embargo notice lists openstack org subject pre ossa vulnerability in openstack project cve this email must be signed with the vmt sender s openpgp key this is the key whose fingerprint is posted at https security openstack org vmt html to linux distros vs openwall org subject vs vulnerability in openstack project cve this email must be signed with the vmt sender s openpgp key and encrypted with the linux distros public key see below note the subject line the first four characters must be vs that is left square bracket lowercase v lowercase s right square bracket space or the list automation may reject the email the message body for both emails should be identical this is an advance warning of a vulnerability discovered in openstack to give you as downstream stakeholders a chance to coordinate the release of fixes and reduce the vulnerability window please treat the following information as confidential until the proposed public disclosure date description proposed patch see attached patches unless a flaw is discovered in them these patches will be merged to their corresponding branches on the public disclosure date cve cve proposed public disclosure date time disclosure 1500utc please do not make the issue public or release public patches before this coordinated embargo date original private report https launchpad net bugs bug for access to read and comment on this report please reply to me with your launchpad username and i will subscribe you vmt_coordinator_name openstack vulnerability management team https security openstack org vmt html use iso 8601 style yyyy mm dd for disclosure proposed patches are attached to the email use something unique and descriptive for the patch attachment file names for example cve 2013 4183 master havana patch or cve 2013 ...