The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.
QosCosGrid Initial Security assessment
Jump to navigation
Jump to search
This wiki page documents the progress of the QCG initial security assessment, from first contact to conclusion on whether to proceed or not.
The final security assessment of the QCG 2.6.1 is available here.
This has sparked the following questions:
- A number of security flaws were found. I would be interested in:
- Which specific vulnerabilities were found?
- Out of those, which ones were fixed?
- Which ones were not fixed in QCG2.6.1?
- The report does not explicitly state whether there are remaining open vulnerabilities
- Certain methodologies were employed with a specific set of tools.
- Is it possible to provide details and results of specific tests?
- Perhaps to a limited distribution list (initially, once QCG would be provisioned, then full disclosure would have to be provided within a well-defined distribution list)
- Have there been dedicated tests around components that require root privileges while running?
- Perhaps these were implicitly covered by the actual tests done; perhaps