...
Term | Definition |
Embargo | A time period where |
Subject Matter Expert (SME) | A developer or other specialist who can provide contextual information that helps to determine the validity and impact of a potential security vulnerability. |
Security SME | A security SME is a specialist who is familiar with the ONAP security vulnerability procedures and security in general. |
Peer reviewed | In the context of a patch, the term peer reviewed refers to the patch having been reviewed by the ONAP vulnerability sub-committee and any other relevant key stakeholders. There is not yet a strict definition of the number of people who need to have reviewed the patch, or how they provide sign off. |
...
All ONAP projects are currently in scope for vulnerability support. The participants of the ONAP projects are expected to support the ONAP vulnerability procedures when required.
/Should be checked with tsc/
As ONAP is very young project with a lot of code coming in every release. Even through we are interested in receiving bugs for all ONAP releases that are currently in use, we will develop patches ONLY FOR THE LATEST RELEASE and FOR THE MASTER BRANCH (next version under development) . Unfortunately ensuring security in very early stages of the project is not always possible, that is why we declare three first releases (Amsterdam, Beijing, Casablanca) as unsupported in terms of security bug fixes. Dublin is going to be first version that will be supported as described by above rule.
Third party components
Third party components (i.e. dependencies) are only in scope for security support if they are statically compiled or otherwise bundled by an ONAP project. Dynamically linked dependencies should patch security issues independent of ONAP.
...
- Create ticket with issue description in Vulnerability Reporting Jira Project (VMS members)
- Make the ticket publicly visible (VMS members)
- Assign the bug to one of VMS members
- Perform bug triage and CVE request if necessary (VMS coordinator)
- Send email containing triage results to ONAP TSC Chair and LFN representative /TSC should decide who is this contact point/(Kenny Paul and Jim Baker)
- Rest of standard process should be followed, skipping embargoed disclosure step
...
- Make the related ticket publicly visible
- If a patch has been already proposed push it immediately to gerrit
- Skip embargoed disclosure.
- Send email confirming that issue has been leaked to ONAP TSC Chair and LFN representative /TSC should decide who is this contact point/LFN representative (Kenny Paul and Jim Baker)
- Rest of standard process should be followed and finished as soon as possible.
...