Difference between revisions of "SVG:General Advisory Template"
Jump to navigation
Jump to search
Line 1: | Line 1: | ||
{{svg-header}} | {{svg-header}} | ||
<pre> | |||
<2021-01-04> | |||
Dates for 2021> | |||
<2020-03-10> | |||
Include Creative Commons Licence for [WHITE] | |||
<Most cases 'ADVISORY' > | |||
<4 Options> | |||
< ‘HEADS UP’ – Sites may be asked to do something urgently soon. | |||
Usually only for vulnerabilities which may be a ‘Critical’> | |||
< ‘ADVISORY’ – Sites normally instructed to do something | |||
The Commonest type of mail, e.g. update when vulnerability fixed in software> | |||
< ‘ALERT’ – Sites should be aware | |||
This may be important to you, you may want to take action. Often ask for feedback | |||
e.g. If any site is aware that any of these or other vulnerabilities presents a serious problem to EGI, please inform the EGI SVG. > | |||
< ‘INFORMATION’ – to inform sites of something | |||
E.g. if a well talked about vulnerability is not relevant> | |||
< E-mail title - as Title > | |||
<add or delete sections as needed> | |||
<add any information required, template is to help, not rigid> | |||
< Fill in advisory number, title, date, and URL> | |||
< Only upload if 'WHITE'> | |||
< Title should include the RISK rating (e. g. CRITICAL, HIGH, ...) if available> | |||
< Title should include software affected> | |||
< If applicable, a CVE number or the like should be included > | |||
< The title should be used as mail subject, and on the wiki, but not included in mail itself. > | |||
< The date section should only be included on the wiki> | |||
< So then the e-mail title starts with the type of notification, then TLP followed by affected software and risk> | |||
Title: EGI SVG 'HEADS UP'/'ADVISORY'/'ALERT'/'INFORMATION' [TLP:<Choose TLP colour>]<RISK> risk <cve, software, other info > if | |||
CVE [EGI-SVG-<cve>] else [EGI-SVG-<year>-<RT-number>] | |||
Date: <date yyyy-mm-dd> <1st released> | |||
Updated: <date yyyy-mm-dd> | |||
Affected software and risk | |||
========================== | |||
<CRITICAL/HIGH/MODERATE/LOW> risk vulnerability concerning <software/package> | |||
Package :<Name of package> | |||
CVE ID :<Include CVE's if present> | |||
Bug ID :<Any identifier by package provider if applicable> | |||
<A few sentences describing the problem > <It was found that SillySoftware exposes users to | |||
unhealthy levels of cute cat pictures. Dog lovers are not at risk. The exposure is present in | |||
versions up to 11.> | |||
Actions required/recommended | |||
============================ | |||
<as appropriate e.g.> | |||
<Sites are required to immediately apply the mitigation described below to all user-accessible systems.> | |||
<Sites running xxx are required to urgently apply vendor kernel updates.> | |||
<Sites running yyy are required to urgently install new version> | |||
<Sites are recommended to update relevant components as soon as it is convenient> | |||
<(For critical) All running resources MUST be either patched or have mitigation | |||
in place or software removed by yyyy-mm-dd 00:00 UTC | |||
Sites failing to act and/or failing to respond to requests from the EGI CSIRT team risk site suspension. > | |||
<7 calendar days - plus whatever it takes to get to 00:00 - but if the date falls on a Friday or | |||
common public holiday, make it the first working day after people are expected back> | |||
<If high and may become critical> | |||
<Sites should be aware that if a public exploit is released which allows easy root access in the EGI infrastructure this vulnerability is likely to be elevated to 'Critical' and sites will then be required to patch within 7 days or risk suspension. > | |||
<Mostly for 'Alert' - If anyone becomes aware of any situation where this vulnerability has a significant impact on the EGI infrastructure then please inform EGI SVG.> | |||
Component installation information | |||
================================== | |||
The official repository for the distribution of grid middleware for EGI sites is | |||
repository.egi.eu which contains the EGI Unified Middleware Distribution (UMD). | |||
Sites using the EGI UMD 4 should see: | |||
http://repository.egi.eu/category/umd_releases/distribution/umd-4/ | |||
XXX is now (also) available in EPEL | |||
https://fedoraproject.org/wiki/EPEL | |||
<e.g. patch not yet available> | |||
<e.g. patch available from vendor for x system but not y> | |||
<e.g. pointer to UMD release > | |||
OR | |||
<refer to wlcg repository http://linuxsoft.cern.ch/wlcg/ > | |||
OR | |||
<References to appropriate other software.> | |||
OR | |||
<List vendors who have already announced patches with references> | |||
Mitigation | |||
========== | |||
<If appropriate - Describe mitigation to carry out - this may be to run a script> | |||
< If possible, include either a script and/or include command lines> | |||
< or refer to vendors mitivation> | |||
Affected software details | |||
========================= | |||
<This can be omitted if the situation is sufficiently simple to include version info in the | |||
affected software and risk. For example this may be included if it is quite complex which versions | |||
of e.g. Linux are affected.> | |||
<e.g. which version(s) of Linux are effected> | |||
<e.g. which middleware component is effected within gLite/ARC/Unicore/Globus/Other> | |||
More information | |||
================ | |||
<Describe the reason for the issuing of this advisory> | |||
< A vulnerability has been found in <xxx> software which is part of the <yyy> distribution.> | |||
<this could include - e.g. updated as patch available> | |||
<include cve- number if one has been issued> | |||
<describe the problem, something about why it occurs, and the effect on sites> | |||
<In the case of announced vulnerabilities, simply a reference to the SW provider's info may be sufficient.> | |||
TLP and URL | |||
=========== | |||
< Choose proper TLP color > | |||
** WHITE information - Unlimited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions*** | |||
or | |||
** GREEN information - Community wide distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** | |||
or | |||
** or | |||
** AMBER information - Limited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** | |||
or | |||
** RED information - Personal for Named Recipients Only - see | |||
https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** | |||
<Put on Wiki for WHITE information only> | |||
<(If not public and High or Critical) - This advisory will be placed on the wiki on or after yyyy-mm-dd (2 weeks later). There may be other reasons why not public. > | |||
URL: https://wiki.egi.eu/wiki/SVG:Advisory-SVG-<year>-<RT-number> or | |||
URL: https://wiki.egi.eu/wiki/SVG:Advisory-SVG-<CVE ID> | |||
Minor updates may be made without re-distribution to the sites | |||
Comments | |||
======== | |||
Comments or questions should be sent to svg-rat at mailman.egi.eu | |||
If you find or become aware of another vulnerability which is relevant to EGI you may report it by e-mail to | |||
report-vulnerability at egi.eu | |||
the EGI Software Vulnerability Group will take a look according to the procedure defined in [R X] | |||
Note that this is undergoing revision to fully handle vulnerabilities in the EOSC-hub era. | |||
References | |||
========== | |||
<Any references to the vulnerability> | |||
<refer to any public disclosure> | |||
<e.g. Linux vendors info> | |||
<any other info on the problem> | |||
<Useful skeletons> | |||
< NVD https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-nnnn > | |||
< http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-nnnn > | |||
< Red Hat https://access.redhat.com/security/cve/CVE-2021-nnnn > | |||
< https://www.scientificlinux.org/category/sl-errata/ > | |||
< CentOS https://lists.centos.org/pipermail/centos-announce/ > | |||
< Ubuntu http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2021-nnnn.html > | |||
< Debian https://security-tracker.debian.org/tracker/CVE-2021-nnnn > | |||
[R X] https://documents.egi.eu/public/ShowDocument?docid=3145 | |||
Credit | |||
====== | |||
This vulnerability was reported by <if applicable - person who discovers vulnerability> | |||
or | |||
SVG was alerted to this vulnerability by <if applicable - person who alerts SVG to a vulnerability> | |||
Timeline | |||
======== | |||
Yyyy-mm-dd [EGI-SVG-<year>-<RT-number>] | |||
2021-??-?? Vulnerability reported by <name1> or SVG alerted to this issue by <name1> | |||
2021-??-?? Acknowledgement from the EGI SVG to the reporter | |||
2021-??-?? (if appropriate) Software providers responded and involved in investigation | |||
2021-??-?? Investigation of vulnerability and relevance to EGI carried out by (as appropriate) | |||
2021-??-?? EGI SVG Risk Assessment completed | |||
2021-??-?? (if appropriate)Assessment by the EGI Software Vulnerability Group reported to the software providers | |||
2021-??-?? Updated packages available <in the EGI UMD/other location> | |||
2021-??-?? Advisory/Alert sent to sites | |||
2021-??-?? Public disclosure | |||
Context | |||
======= | |||
This advisory has been prepared as part of the effort to fulfil EGI SVG's purpose | |||
"To minimize the risk to the EGI infrastructure arising from software vulnerabilities" | |||
The risk is that assessed by the group, according to the EGI SVG issue handling procedure [R X] in the context of how the software is used in the EGI infrastructure. It is the opinion of the group, we do not guarantee it to be correct. The risk may also be higher or lower in other deployments depending on how the software is used. | |||
For [WHITE] information:-- | |||
----------------------------- | |||
This advisory is subject to the Creative commons licence https://creativecommons.org/licenses/by/4.0/ and the EGI https://www.egi.eu/ Software Vulnerability Group must be credited. | |||
----------------------------- | |||
For [GREEN] and [AMBER] informatin:-- | |||
----------------------------- | |||
Others may re-use this information provided they:- | |||
1) Respect the provided TLP classification | |||
2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group | |||
------------------------------ | |||
Note that the SVG issue handling procedure is currently under review, to take account of the increasing inhomogeneity of the EGI infrastructure and the services in the EOSC-hub catalogue. | |||
On behalf of the EGI SVG, | |||
</pre> | |||
<pre> | <pre> |
Revision as of 12:31, 24 February 2021
Main page | Software Security Checklist | Issue Handling | Advisories | Notes On Risk | Advisory Template | More |
General Advisory Template
<2021-01-04> Dates for 2021> <2020-03-10> Include Creative Commons Licence for [WHITE] <Most cases 'ADVISORY' > <4 Options> < ‘HEADS UP’ – Sites may be asked to do something urgently soon. Usually only for vulnerabilities which may be a ‘Critical’> < ‘ADVISORY’ – Sites normally instructed to do something The Commonest type of mail, e.g. update when vulnerability fixed in software> < ‘ALERT’ – Sites should be aware This may be important to you, you may want to take action. Often ask for feedback e.g. If any site is aware that any of these or other vulnerabilities presents a serious problem to EGI, please inform the EGI SVG. > < ‘INFORMATION’ – to inform sites of something E.g. if a well talked about vulnerability is not relevant> < E-mail title - as Title > <add or delete sections as needed> <add any information required, template is to help, not rigid> < Fill in advisory number, title, date, and URL> < Only upload if 'WHITE'> < Title should include the RISK rating (e. g. CRITICAL, HIGH, ...) if available> < Title should include software affected> < If applicable, a CVE number or the like should be included > < The title should be used as mail subject, and on the wiki, but not included in mail itself. > < The date section should only be included on the wiki> < So then the e-mail title starts with the type of notification, then TLP followed by affected software and risk> Title: EGI SVG 'HEADS UP'/'ADVISORY'/'ALERT'/'INFORMATION' [TLP:<Choose TLP colour>]<RISK> risk <cve, software, other info > if CVE [EGI-SVG-<cve>] else [EGI-SVG-<year>-<RT-number>] Date: <date yyyy-mm-dd> <1st released> Updated: <date yyyy-mm-dd> Affected software and risk ========================== <CRITICAL/HIGH/MODERATE/LOW> risk vulnerability concerning <software/package> Package :<Name of package> CVE ID :<Include CVE's if present> Bug ID :<Any identifier by package provider if applicable> <A few sentences describing the problem > <It was found that SillySoftware exposes users to unhealthy levels of cute cat pictures. Dog lovers are not at risk. The exposure is present in versions up to 11.> Actions required/recommended ============================ <as appropriate e.g.> <Sites are required to immediately apply the mitigation described below to all user-accessible systems.> <Sites running xxx are required to urgently apply vendor kernel updates.> <Sites running yyy are required to urgently install new version> <Sites are recommended to update relevant components as soon as it is convenient> <(For critical) All running resources MUST be either patched or have mitigation in place or software removed by yyyy-mm-dd 00:00 UTC Sites failing to act and/or failing to respond to requests from the EGI CSIRT team risk site suspension. > <7 calendar days - plus whatever it takes to get to 00:00 - but if the date falls on a Friday or common public holiday, make it the first working day after people are expected back> <If high and may become critical> <Sites should be aware that if a public exploit is released which allows easy root access in the EGI infrastructure this vulnerability is likely to be elevated to 'Critical' and sites will then be required to patch within 7 days or risk suspension. > <Mostly for 'Alert' - If anyone becomes aware of any situation where this vulnerability has a significant impact on the EGI infrastructure then please inform EGI SVG.> Component installation information ================================== The official repository for the distribution of grid middleware for EGI sites is repository.egi.eu which contains the EGI Unified Middleware Distribution (UMD). Sites using the EGI UMD 4 should see: http://repository.egi.eu/category/umd_releases/distribution/umd-4/ XXX is now (also) available in EPEL https://fedoraproject.org/wiki/EPEL <e.g. patch not yet available> <e.g. patch available from vendor for x system but not y> <e.g. pointer to UMD release > OR <refer to wlcg repository http://linuxsoft.cern.ch/wlcg/ > OR <References to appropriate other software.> OR <List vendors who have already announced patches with references> Mitigation ========== <If appropriate - Describe mitigation to carry out - this may be to run a script> < If possible, include either a script and/or include command lines> < or refer to vendors mitivation> Affected software details ========================= <This can be omitted if the situation is sufficiently simple to include version info in the affected software and risk. For example this may be included if it is quite complex which versions of e.g. Linux are affected.> <e.g. which version(s) of Linux are effected> <e.g. which middleware component is effected within gLite/ARC/Unicore/Globus/Other> More information ================ <Describe the reason for the issuing of this advisory> < A vulnerability has been found in <xxx> software which is part of the <yyy> distribution.> <this could include - e.g. updated as patch available> <include cve- number if one has been issued> <describe the problem, something about why it occurs, and the effect on sites> <In the case of announced vulnerabilities, simply a reference to the SW provider's info may be sufficient.> TLP and URL =========== < Choose proper TLP color > ** WHITE information - Unlimited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions*** or ** GREEN information - Community wide distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** or ** or ** AMBER information - Limited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** or ** RED information - Personal for Named Recipients Only - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** <Put on Wiki for WHITE information only> <(If not public and High or Critical) - This advisory will be placed on the wiki on or after yyyy-mm-dd (2 weeks later). There may be other reasons why not public. > URL: https://wiki.egi.eu/wiki/SVG:Advisory-SVG-<year>-<RT-number> or URL: https://wiki.egi.eu/wiki/SVG:Advisory-SVG-<CVE ID> Minor updates may be made without re-distribution to the sites Comments ======== Comments or questions should be sent to svg-rat at mailman.egi.eu If you find or become aware of another vulnerability which is relevant to EGI you may report it by e-mail to report-vulnerability at egi.eu the EGI Software Vulnerability Group will take a look according to the procedure defined in [R X] Note that this is undergoing revision to fully handle vulnerabilities in the EOSC-hub era. References ========== <Any references to the vulnerability> <refer to any public disclosure> <e.g. Linux vendors info> <any other info on the problem> <Useful skeletons> < NVD https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-nnnn > < http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-nnnn > < Red Hat https://access.redhat.com/security/cve/CVE-2021-nnnn > < https://www.scientificlinux.org/category/sl-errata/ > < CentOS https://lists.centos.org/pipermail/centos-announce/ > < Ubuntu http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2021-nnnn.html > < Debian https://security-tracker.debian.org/tracker/CVE-2021-nnnn > [R X] https://documents.egi.eu/public/ShowDocument?docid=3145 Credit ====== This vulnerability was reported by <if applicable - person who discovers vulnerability> or SVG was alerted to this vulnerability by <if applicable - person who alerts SVG to a vulnerability> Timeline ======== Yyyy-mm-dd [EGI-SVG-<year>-<RT-number>] 2021-??-?? Vulnerability reported by <name1> or SVG alerted to this issue by <name1> 2021-??-?? Acknowledgement from the EGI SVG to the reporter 2021-??-?? (if appropriate) Software providers responded and involved in investigation 2021-??-?? Investigation of vulnerability and relevance to EGI carried out by (as appropriate) 2021-??-?? EGI SVG Risk Assessment completed 2021-??-?? (if appropriate)Assessment by the EGI Software Vulnerability Group reported to the software providers 2021-??-?? Updated packages available <in the EGI UMD/other location> 2021-??-?? Advisory/Alert sent to sites 2021-??-?? Public disclosure Context ======= This advisory has been prepared as part of the effort to fulfil EGI SVG's purpose "To minimize the risk to the EGI infrastructure arising from software vulnerabilities" The risk is that assessed by the group, according to the EGI SVG issue handling procedure [R X] in the context of how the software is used in the EGI infrastructure. It is the opinion of the group, we do not guarantee it to be correct. The risk may also be higher or lower in other deployments depending on how the software is used. For [WHITE] information:-- ----------------------------- This advisory is subject to the Creative commons licence https://creativecommons.org/licenses/by/4.0/ and the EGI https://www.egi.eu/ Software Vulnerability Group must be credited. ----------------------------- For [GREEN] and [AMBER] informatin:-- ----------------------------- Others may re-use this information provided they:- 1) Respect the provided TLP classification 2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group ------------------------------ Note that the SVG issue handling procedure is currently under review, to take account of the increasing inhomogeneity of the EGI infrastructure and the services in the EOSC-hub catalogue. On behalf of the EGI SVG,
<2020-03-10> Include Creative Commons Licence for [WHITE] <Most cases 'ADVISORY' > <4 Options> < ‘HEADS UP’ – Sites may be asked to do something urgently soon. Usually only for vulnerabilities which may be a ‘Critical’> < ‘ADVISORY’ – Sites normally instructed to do something The Commonest type of mail, e.g. update when vulnerability fixed in software> < ‘ALERT’ – Sites should be aware This may be important to you, you may want to take action. Often ask for feedback e.g. If any site is aware that any of these or other vulnerabilities presents a serious problem to EGI, please inform the EGI SVG. > < ‘INFORMATION’ – to inform sites of something E.g. if a well talked about vulnerability is not relevant> < E-mail title - as Title > <add or delete sections as needed> <add any information required, template is to help, not rigid> < Fill in advisory number, title, date, and URL> < Only upload if 'WHITE'> < Title should include the RISK rating (e. g. CRITICAL, HIGH, ...) if available> < Title should include software affected> < If applicable, a CVE number or the like should be included > < The title should be used as mail subject, and on the wiki, but not included in mail itself. > < The date section should only be included on the wiki> < So then the e-mail title starts with the type of notification, then TLP followed by affected software and risk> Title: EGI SVG 'HEADS UP'/'ADVISORY'/'ALERT'/'INFORMATION' [TLP:<Choose TLP colour>]<RISK> risk <cve, software, other info > if CVE [EGI-SVG-<cve>] else [EGI-SVG-<year>-<RT-number>] Date: <date yyyy-mm-dd> <1st released> Updated: <date yyyy-mm-dd> Affected software and risk ========================== <CRITICAL/HIGH/MODERATE/LOW> risk vulnerability concerning <software/package> Package :<Name of package> CVE ID :<Include CVE's if present> Bug ID :<Any identifier by package provider if applicable> <A few sentences describing the problem > <It was found that SillySoftware exposes users to unhealthy levels of cute cat pictures. Dog lovers are not at risk. The exposure is present in versions up to 11.> Actions required/recommended ============================ <as appropriate e.g.> <Sites are required to immediately apply the mitigation described below to all user-accessible systems.> <Sites running xxx are required to urgently apply vendor kernel updates.> <Sites running yyy are required to urgently install new version> <Sites are recommended to update relevant components as soon as it is convenient> <(For critical) All running resources MUST be either patched or have mitigation in place or software removed by yyyy-mm-dd 00:00 UTC Sites failing to act and/or failing to respond to requests from the EGI CSIRT team risk site suspension. > <7 calendar days - plus whatever it takes to get to 00:00 - but if the date falls on a Friday or common public holiday, make it the first working day after people are expected back> <If high and may become critical> <Sites should be aware that if a public exploit is released which allows easy root access in the EGI infrastructure this vulnerability is likely to be elevated to 'Critical' and sites will then be required to patch within 7 days or risk suspension. > <Mostly for 'Alert' - If anyone becomes aware of any situation where this vulnerability has a significant impact on the EGI infrastructure then please inform EGI SVG.> Component installation information ================================== The official repository for the distribution of grid middleware for EGI sites is repository.egi.eu which contains the EGI Unified Middleware Distribution (UMD). Sites using the EGI UMD 4 should see: http://repository.egi.eu/category/umd_releases/distribution/umd-4/ XXX is now (also) available in EPEL https://fedoraproject.org/wiki/EPEL <e.g. patch not yet available> <e.g. patch available from vendor for x system but not y> <e.g. pointer to UMD release > OR <refer to wlcg repository http://linuxsoft.cern.ch/wlcg/ > OR <References to appropriate other software.> OR <List vendors who have already announced patches with references> Mitigation ========== <If appropriate - Describe mitigation to carry out - this may be to run a script> < If possible, include either a script and/or include command lines> < or refer to vendors mitivation> Affected software details ========================= <This can be omitted if the situation is sufficiently simple to include version info in the affected software and risk. For example this may be included if it is quite complex which versions of e.g. Linux are affected.> <e.g. which version(s) of Linux are effected> <e.g. which middleware component is effected within gLite/ARC/Unicore/Globus/Other> More information ================ <Describe the reason for the issuing of this advisory> < A vulnerability has been found in <xxx> software which is part of the <yyy> distribution.> <this could include - e.g. updated as patch available> <include cve- number if one has been issued> <describe the problem, something about why it occurs, and the effect on sites> <In the case of announced vulnerabilities, simply a reference to the SW provider's info may be sufficient.> TLP and URL =========== < Choose proper TLP color > ** WHITE information - Unlimited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions*** or ** GREEN information - Community wide distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** or ** or ** AMBER information - Limited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** or ** RED information - Personal for Named Recipients Only - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions ** <Put on Wiki for WHITE information only> <(If not public and High or Critical) - This advisory will be placed on the wiki on or after yyyy-mm-dd (2 weeks later). There may be other reasons why not public. > URL: https://wiki.egi.eu/wiki/SVG:Advisory-SVG-<year>-<RT-number> or URL: https://wiki.egi.eu/wiki/SVG:Advisory-SVG-<CVE ID> Minor updates may be made without re-distribution to the sites Comments ======== Comments or questions should be sent to svg-rat at mailman.egi.eu If you find or become aware of another vulnerability which is relevant to EGI you may report it by e-mail to report-vulnerability at egi.eu the EGI Software Vulnerability Group will take a look according to the procedure defined in [R X] Note that this is undergoing revision to fully handle vulnerabilities in the EOSC-hub era. References ========== <Any references to the vulnerability> <refer to any public disclosure> <e.g. Linux vendors info> <any other info on the problem> <Useful skeletons> < NVD https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-nnnn > < http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-nnnn > < Red Hat https://access.redhat.com/security/cve/CVE-2020-nnnn > < https://www.scientificlinux.org/category/sl-errata/ > < CentOS https://lists.centos.org/pipermail/centos-announce/ > < Ubuntu http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-nnnn.html > < Debian https://security-tracker.debian.org/tracker/CVE-2020-nnnn > [R X] https://documents.egi.eu/public/ShowDocument?docid=3145 Credit ====== This vulnerability was reported by <if applicable - person who discovers vulnerability> or SVG was alerted to this vulnerability by <if applicable - person who alerts SVG to a vulnerability> Timeline ======== Yyyy-mm-dd [EGI-SVG-<year>-<RT-number>] 2020-??-?? Vulnerability reported by <name1> or SVG alerted to this issue by <name1> 2020-??-?? Acknowledgement from the EGI SVG to the reporter 2020-??-?? (if appropriate) Software providers responded and involved in investigation 2020-??-?? Investigation of vulnerability and relevance to EGI carried out by (as appropriate) 2020-??-?? EGI SVG Risk Assessment completed 2020-??-?? (if appropriate)Assessment by the EGI Software Vulnerability Group reported to the software providers 2020-??-?? Updated packages available <in the EGI UMD/other location> 2020-??-?? Advisory/Alert sent to sites 2020-??-?? Public disclosure Context ======= This advisory has been prepared as part of the effort to fulfil EGI SVG's purpose "To minimize the risk to the EGI infrastructure arising from software vulnerabilities" The risk is that assessed by the group, according to the EGI SVG issue handling procedure [R X] in the context of how the software is used in the EGI infrastructure. It is the opinion of the group, we do not guarantee it to be correct. The risk may also be higher or lower in other deployments depending on how the software is used. For [WHITE] information:-- ----------------------------- This advisory is subject to the Creative commons license https://creativecommons.org/licenses/by/4.0/ and the EGI https://www.egi.eu/ Software Vulnerability Group must be credited. ----------------------------- For [GREEN] and [AMBER] information:-- ----------------------------- Others may re-use this information provided they:- 1) Respect the provided TLP classification 2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group ------------------------------ Note that the SVG issue handling procedure is currently under review, to take account of the increasing inhomogeneity of the EGI infrastructure and the services in the EOSC-hub catalogue. On behalf of the EGI SVG,
| RAT Issue Handling Instructions | RAT Issue Handling Templates | RAT Issue Handling Templates contd | SVG-CSIRT Critical Notes | Advisory Template |
| Issue Handling Summary | Reporters | SVG View | Software Providers | EGI MW Unit | Deployment | Notes on Risk |