doc: add initial draft of CVE management process #60

mhdawson · 2017-10-25T15:58:41Z

No description provided.

mhdawson · 2017-10-25T16:08:52Z

@nodejs/security @nodejs/security-wg for review/comment.

jasnell · 2017-10-25T16:39:47Z

processes/cve_management_process.md

+# Node.js CVE management process
+
+The Node.js project acts as a Commonn Vulnerabilities and Exposures (CVE)
+Numbering Authority (CNA). The current scope is for all actively


Having Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA) be a link would be good.

jasnell · 2017-10-25T16:40:46Z

processes/cve_management_process.md

+developed versions of software developed under the Node.js project (ie.
+https://github.com/nodejs).  This means that the Node.js team reviews
+CVE requests and if appropriate assigns CVE numbers to vulnerabilities.
+The scope currently **does not** include thir party modules.


Only for Core and Foundation projects or userland modules also?

It is only for Core and Foundation projects. That line tries to say that userland modules are excluded for now. Once we are comfortable with that scope we will consider expanding.

jasnell · 2017-10-25T16:42:20Z

processes/cve_management_process.md

+The CNA program allows the Node.js team to request a block of CVE's in
+advance. These CVE's are managed in an issue within the private Node.js
+security repo (https://github.com/nodejs/security).  Each year there
+will be an issue in that repo titled:


I recommend that we create a separate dedicated repository under the nodejs-private github organization for CVE management. Discussion of assignments would be in issues, actual assignments done as PRs against a master record in the repository.

That would be ok with me as well, just was not sure if we wanted to create additional repos

jasnell · 2017-10-25T16:44:31Z

Excellent start. Thank you for putting this together.

jasnell

LGTM as a starting point. Left a couple comments for iteration.

sam-github · 2017-10-25T17:04:04Z

processes/cve_management_process.md

+developed versions of software developed under the Node.js project (ie.
+https://github.com/nodejs).  This means that the Node.js team reviews
+CVE requests and if appropriate assigns CVE numbers to vulnerabilities.
+The scope currently **does not** include thir party modules.


sam-github · 2017-10-25T17:05:06Z

processes/cve_management_process.md

+   been added to a closed mailing list that is used for announcements,
+   sharing documents, or discussion relevant to the CNA community.
+   The list rarely has more than ten messages a week.
+   **cna-discussion-list** 


"@iojs.org"?

mhdawson · 2017-10-25T18:55:22Z

Pushed update to address some of the initial comments.

I'll leave a bit more time before updating to use a repo in the nodejs-private github organization in order to see if there are any alternatives suggested or concerns raised with doing that.

cjihrig · 2017-10-26T15:51:12Z

processes/cve_management_process.md

@@ -0,0 +1,124 @@
+# Node.js CVE management process
+
+The Node.js project acts as a [Commonn Vulnerabilities and Exposures (CVE)


Commonn -> Common

cjihrig · 2017-10-26T15:52:09Z

processes/cve_management_process.md

+include third party modules.
+
+More detailed information about the CNA program is available in
+https://cve.mitre.org/cve/cna/CNA_Rules_v1.1.pdf


Perhaps create a link here?

cjihrig · 2017-10-26T15:53:34Z

processes/cve_management_process.md

+
+The CNA program allows the Node.js team to request a block of CVE's in
+advance. These CVE's are managed in an issue within the private Node.js
+security repo (https://github.com/nodejs/security).  Each year there


Maybe just make "security repo" a link and drop the explicit URL.

cjihrig · 2017-10-26T15:53:58Z

processes/cve_management_process.md

+CVE Block for XXXX
+```
+
+were XXXX is the year (for example `CVE Block for 2017`).


were -> where

cjihrig · 2017-10-26T15:54:16Z

processes/cve_management_process.md

+* Announced 
+
+
+When a new block of CVEs  is received from Mitre they will be listed under


Extra space after CVEs

cjihrig · 2017-10-26T15:56:05Z

processes/cve_management_process.md

+
+When a request for a CVE is received via the cve-request@iojs.org
+email alias the following process will be followed (likely updated
+after we get hacker one up and running).


hacker one -> HackerOne

cjihrig · 2017-10-26T15:56:29Z

processes/cve_management_process.md

+
+* Respond to the requestor indicating that we have the request
+  and will review soon.
+* Open an issue in the security repo for the request


Missing a period at the end of the line.

cjihrig · 2017-10-26T15:56:52Z

processes/cve_management_process.md

+* Review the request.
+  * If a CVE is appropriate then assign the
+    CVE as outline in the section titled
+    `CVE Management processes for Node.js vulnerabilities` and


Should this link to the section?

cjihrig · 2017-10-26T15:58:02Z

processes/cve_management_process.md

+* Move the CVE from the unassigned block, to the Pending section along
+  with a link to the issue in the security repo that is being used
+  to discuss the vulnerability.
+* As part of the security announcement process 


Maybe just link this and drop the explicit URL.

cjihrig · 2017-10-26T15:58:20Z

processes/cve_management_process.md

+  commonly done by including it is the draft for the announcement that
+  will go out once the associated security releases are availble.
+* Once the security announcement goes out:
+  * Use the Mitre form (https://cveform.mitre.org/) to report the


Link and drop the explicit URL?

mhdawson · 2017-10-27T20:35:38Z

@jasnell pushed commit to address suggestion to use repo in nodejs-private instead of issue in security repo.

mhdawson · 2017-10-31T14:07:12Z

@cjihrig can you take another look.

PR-URL: #60 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

mhdawson · 2017-10-31T20:40:31Z

Landed as c2bf31b

PR-URL: nodejs/security-wg#60 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

mhdawson added 2 commits October 25, 2017 11:57

doc: add initial draft of CVE management process

211f3a3

squash: misc fixups

68a9372

mhdawson self-assigned this Oct 25, 2017

mhdawson mentioned this pull request Oct 25, 2017

CVE management process for Node.js #33

Closed

jasnell reviewed Oct 25, 2017

View reviewed changes

jasnell approved these changes Oct 25, 2017

View reviewed changes

sam-github reviewed Oct 25, 2017

View reviewed changes

squash: address initial comments

8cb697b

cjihrig reviewed Oct 26, 2017

View reviewed changes

mhdawson added 3 commits October 27, 2017 12:49

squash: address comments

367d1ba

squash: address comments

8bb9ad3

squash: address comments

0c2adf5

sam-github approved these changes Oct 27, 2017

View reviewed changes

squash: address comments - move to using private repo

4f21daf

cjihrig approved these changes Oct 31, 2017

View reviewed changes

mhdawson added a commit that referenced this pull request Oct 31, 2017

doc: add initial draft of CVE management process

c2bf31b

PR-URL: #60 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

mhdawson closed this Oct 31, 2017

		@@ -0,0 +1,124 @@
		# Node.js CVE management process

		The Node.js project acts as a [Commonn Vulnerabilities and Exposures (CVE)

		* Announced


		When a new block of CVEs is received from Mitre they will be listed under

doc: add initial draft of CVE management process #60

doc: add initial draft of CVE management process #60

Conversation

mhdawson commented Oct 25, 2017

mhdawson commented Oct 25, 2017

jasnell Oct 25, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jasnell commented Oct 25, 2017

jasnell left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhdawson commented Oct 25, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhdawson commented Oct 27, 2017

mhdawson commented Oct 31, 2017

mhdawson commented Oct 31, 2017

jasnell Oct 25, 2017 •

edited

Loading