kubernetes / kubernetes/sig-security

Create a periodically auto-refreshing list of fixed CVEs

Open
#1 60 comments 2 reactions 2 assignees Claimed by @nehaLohia27 View on GitHub
committee/security-response lifecycle/stale sig/docs sig/release sig/security
Dominant language
Go
Stars
249
Forks
82
Avg merge
7d 12h
Merged PRs (30d)
2

Description

With growing number of eyes on Kubernetes, the number of CVEs related to Kubernetes have increased. Although most CVEs are regularly fixed that directly or indirectly or transitively impact Kubernetes, there is no single place to programmatically subscribe or pull the data of fixed CVEs, for the end users of Kubernetes.

### Current State of the Art

All these options are broken or incomplete:

1. RSS feed with google groups is broken: https://github.com/kubernetes/website/issues/29142
2. [CVEDetails](https://www.cvedetails.com/vulnerability-list/vendor_id-15867/product_id-34016/Kubernetes-Kubernetes.html
) website seems to have incomplete data, with missing CVEs from 2021 and no mention of CVEs in base image or build time deps.
3. This page: https://kubernetes.io/docs/reference/issues-security/issues/ links to a Github issue filter for CVE related fixes but is a broad search term

### Metadata
* Issue: https://github.com/kubernetes/enhancements/issues/3203

### Pre-requisites

- [x] https://github.com/kubernetes/test-infra/pull/23428
- [x] Search and Identify closed issues that have a CVE ID e.g. CVE-1001-12345 in the issue description or summary (This search [filter](https://api.github.com/search/issues?q=is:issue+label:official-cve-feed+state:closed+repo:kubernetes/kubernetes) is giving the most accurate data so far)
- [x] Label those issues with `official-cve-feed` using https://docs.github.com/en/rest/reference/issues REST API
- [x] https://github.com/kubernetes/committee-security-response/pull/133

### Implementation Details
https://github.com/kubernetes/enhancements/tree/master/keps/sig-security/3203-auto-refreshing-official-cve-feed

TestGrid for GCS Bucket is available here: https://testgrid.k8s.io/sig-security-cve-feed#auto-refreshing-official-cve-feed

Optional: Trigger `k/website` rebuild using netlify [build-hook](https://docs.netlify.com/configure-builds/build-hooks/)

### Beta to GA Graduation Scope

- [x] https://github.com/kubernetes/org/issues/4873
- [x] https://github.com/kubernetes/kubernetes/issues/123964
- [x] https://github.com/kubernetes/website/issues/45576
- [ ] https://github.com/kubernetes/website/issues/43968
- [x] https://github.com/kubernetes/sig-security/issues/98

```[tasklist]
### Alpha to Beta Graduation Scope
- [x] https://github.com/kubernetes/sig-security/issues/77
- [x] https://github.com/kubernetes/sig-security/issues/73
- [x] https://github.com/kubernetes/sig-security/issues/71
- [x] https://github.com/kubernetes/sig-security/issues/72
- [x] https://github.com/kubernetes/website/issues/36808
- [x] https://github.com/kubernetes/sig-security/issues/63
```

```[tasklist]
### Feedback since `beta` that is resolved
- [ ] https://github.com/kubernetes/sig-security/issues/97
- [ ] https://github.com/kubernetes/kubernetes/issues/118437
- [ ] https://github.com/kubernetes/sig-security/pull/92
- [ ] https://github.com/kubernetes/sig-security/pull/106
- [ ] https://github.com/kubernetes/sig-security/issues/85
- [ ] https://github.com/kubernetes/test-infra/pull/31076
```

### Feedback received but that requires more engagement and participation

- [ ] Support similar feeds for all CNCF projects

### Related Discussions
- https://github.com/kubernetes/security/issues/57
- https://github.com/kubernetes/kubernetes/issues/89130
- Slack thread: https://kubernetes.slack.com/archives/C8P1DRTJA/p1632909102076400

cc @sftim @tallclair @kubernetes/sig-security-leads @raesene

/committee product-security
/sig security docs release

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.