kubernetes / kubernetes/sig-security
Create a periodically auto-refreshing list of fixed CVEs
- Dominant language
- Go
- Stars
- 249
- Forks
- 82
- Avg merge
- 7d 12h
- Merged PRs (30d)
- 2
Description
With growing number of eyes on Kubernetes, the number of CVEs related to Kubernetes have increased. Although most CVEs are regularly fixed that directly or indirectly or transitively impact Kubernetes, there is no single place to programmatically subscribe or pull the data of fixed CVEs, for the end users of Kubernetes.
### Current State of the Art
All these options are broken or incomplete:
1. RSS feed with google groups is broken: https://github.com/kubernetes/website/issues/29142
2. [CVEDetails](https://www.cvedetails.com/vulnerability-list/vendor_id-15867/product_id-34016/Kubernetes-Kubernetes.html
) website seems to have incomplete data, with missing CVEs from 2021 and no mention of CVEs in base image or build time deps.
3. This page: https://kubernetes.io/docs/reference/issues-security/issues/ links to a Github issue filter for CVE related fixes but is a broad search term
### Metadata
* Issue: https://github.com/kubernetes/enhancements/issues/3203
### Pre-requisites
- [x] https://github.com/kubernetes/test-infra/pull/23428
- [x] Search and Identify closed issues that have a CVE ID e.g. CVE-1001-12345 in the issue description or summary (This search [filter](https://api.github.com/search/issues?q=is:issue+label:official-cve-feed+state:closed+repo:kubernetes/kubernetes) is giving the most accurate data so far)
- [x] Label those issues with `official-cve-feed` using https://docs.github.com/en/rest/reference/issues REST API
- [x] https://github.com/kubernetes/committee-security-response/pull/133
### Implementation Details
https://github.com/kubernetes/enhancements/tree/master/keps/sig-security/3203-auto-refreshing-official-cve-feed
TestGrid for GCS Bucket is available here: https://testgrid.k8s.io/sig-security-cve-feed#auto-refreshing-official-cve-feed
Optional: Trigger `k/website` rebuild using netlify [build-hook](https://docs.netlify.com/configure-builds/build-hooks/)
### Beta to GA Graduation Scope
- [x] https://github.com/kubernetes/org/issues/4873
- [x] https://github.com/kubernetes/kubernetes/issues/123964
- [x] https://github.com/kubernetes/website/issues/45576
- [ ] https://github.com/kubernetes/website/issues/43968
- [x] https://github.com/kubernetes/sig-security/issues/98
```[tasklist]
### Alpha to Beta Graduation Scope
- [x] https://github.com/kubernetes/sig-security/issues/77
- [x] https://github.com/kubernetes/sig-security/issues/73
- [x] https://github.com/kubernetes/sig-security/issues/71
- [x] https://github.com/kubernetes/sig-security/issues/72
- [x] https://github.com/kubernetes/website/issues/36808
- [x] https://github.com/kubernetes/sig-security/issues/63
```
```[tasklist]
### Feedback since `beta` that is resolved
- [ ] https://github.com/kubernetes/sig-security/issues/97
- [ ] https://github.com/kubernetes/kubernetes/issues/118437
- [ ] https://github.com/kubernetes/sig-security/pull/92
- [ ] https://github.com/kubernetes/sig-security/pull/106
- [ ] https://github.com/kubernetes/sig-security/issues/85
- [ ] https://github.com/kubernetes/test-infra/pull/31076
```
### Feedback received but that requires more engagement and participation
- [ ] Support similar feeds for all CNCF projects
### Related Discussions
- https://github.com/kubernetes/security/issues/57
- https://github.com/kubernetes/kubernetes/issues/89130
- Slack thread: https://kubernetes.slack.com/archives/C8P1DRTJA/p1632909102076400
cc @sftim @tallclair @kubernetes/sig-security-leads @raesene
/committee product-security
/sig security docs release
Contributor guide
Assessment
This issue has not been assessed yet.