Hi all,
Following up on this issue...
On Fri, Jun 9, 2023 at 12:41 PM Emilia Torino
<emilia.torino@xxxxxxxxxxxxx> wrote:
Hi all,
On 9/6/23 06:20, Cristovao Cordeiro wrote:
> Sounds good to me. @Emilia Torino
> <mailto:emilia.torino@xxxxxxxxxxxxx> do you need those
repos to exist in
> Docker Hub before you can onboard these?
We don't. Since we don't scan the upstream based ROCKs (we
only need
this for the deb based ones).
>
> On Fri, Jun 9, 2023 at 10:42 AM Luca Bello
<luca.bello@xxxxxxxxxxxxx
> <mailto:luca.bello@xxxxxxxxxxxxx>> wrote:
>
> Hello everyone,
>
> as mentioned before, the ROCKs we have are all based on
upstream
> projects; the list is the following, as required:
>
> * Alertmanager (https://github.com/prometheus/alertmanager
> <https://github.com/prometheus/alertmanager>)
> * Grafana Agent (https://github.com/grafana/agent
> <https://github.com/grafana/agent>)
> * Grafana (https://github.com/grafana/grafana
> <https://github.com/grafana/grafana>)
> * Loki (https://github.com/grafana/loki
> <https://github.com/grafana/loki>)
> * Mimir (https://github.com/grafana/mimir
> <https://github.com/grafana/mimir>)
> * SeaweedFS (https://github.com/seaweedfs/seaweedfs
> <https://github.com/seaweedfs/seaweedfs>)
> * Traefik (https://github.com/traefik/traefik
> <https://github.com/traefik/traefik>)
>
> Please let me know if any of these qualifies!
I am not sure how urgent is this, but if you help me identify
the Ubuntu
source packages associated we can make this faster. Otherwise
we can
work on this next week.
Did you have a chance to check this?
>
>
> Cheers,
>
> Luca
>
> On 31/05/2023 18:29, Cristovao Cordeiro wrote:
>>
>> So the only change from our side will be to add
>> prometheus to the email notification subject (or I
guess we
>> can just
>> simple replace it with "CVEs potentially affecting
upstream based
>> ROCKs"). Are the email recipients the same ones
for the other
>> ones?
>>
>>
>> I think that would be fine for now. I'm reluctant
to use the
>> mailing list as a catch-all, but I think we can
re-design this
>> once there is an event bus at Canonical, so we rely
less on emails.
>>
>> As for the other 10 ROCKs, @Luca Bello
>> <mailto:luca.bello@xxxxxxxxxxxxx> let's first do the
right due
>> diligence on those, cause if a ROCK is not meant to be
under the
>> "ubuntu" namespace, then this security monitoring
doesn't need to
>> apply.
>>
>> On Wed, May 31, 2023 at 3:58 PM Emilia Torino
>> <emilia.torino@xxxxxxxxxxxxx
<mailto:emilia.torino@xxxxxxxxxxxxx>>
>> wrote:
>>
>>
>> Hi all,
>>
>> On 31/5/23 04:03, Luca Bello wrote:
>> > Hi everyone,
>> >
>> > as said in the thread already, the prometheus
image is
>> indeed a ROCK
>> > based on the *prometheus/prometheus* repository.
>>
>> That's very convenient. But just to be clear
again, we are not
>> "inspecting" the upstream based rocks the same way
we do for
>> the deb
>> based ones. We are only monitoring new CVEs
created for
>> prometheus,
>> protobuf and consul. So the only change from our
side will be
>> to add
>> prometheus to the email notification subject (or I
guess we
>> can just
>> simple replace it with "CVEs potentially affecting
upstream based
>> ROCKs"). Are the email recipients the same ones
for the other
>> ones?
>>
>> >
>> > We're in the process of updating all of our
ROCKs in a
>> similar way,
>> > meaning we want to make sure we are complying
with any
>> guidelines you
>> > might have on them.
>> > We have about 10 ROCKs at the moment, mostly
based on
>> upstream projects
>> > just like this one. Should I share the full
list, so you can
>> track them?
>>
>> I am happy to do an analysis of this list to see
if we can add
>> more. The
>> short answer would be that if the software is
packaged as a
>> deb in main
>> or universe (which is the situation for
prometheus, protobuf
>> and consul)
>> then we can simply add them. This is because the
service is
>> based on the
>> existing CVE triage work the security team does,
which is
>> mainly for
>> debs (although now is being extended to other
ecosystems
>> because of SOSS
>> but it is still limited and mainly supporting
NVIDIA software).
>>
>> A simple improvement though could be to map the
projects to
>> the rocks so
>> you dont get a general notification, but one per
ROCK as the
>> USNs/debs
>> based service does. We can work on adding this for
the next cycle.
>>
>> >
>> >
>> > Cheers,
>> >
>> > Luca
>> >
>> >
>> > On 31/05/2023 08:12, Cristovao Cordeiro wrote:
>> >> Thank you for the swift action, Emilia!
>> >>
>> >> > Does this
>> >> > relate to a question being asked some hours
ago in
>> >> > ~Security
>> >>
>>
https://chat.canonical.com/canonical/pl/dchhoa7wxtyiper7rbk8h43mjo
<https://chat.canonical.com/canonical/pl/dchhoa7wxtyiper7rbk8h43mjo>?
>> >>
>> >> Yes, precisely. @Luca Bello
>> <mailto:luca.bello@xxxxxxxxxxxxx
>> <mailto:luca.bello@xxxxxxxxxxxxx>> is in
>> >> the process of updating that image and we're
re-doing our
>> due diligence.
>> >> Luca can confirm, but this seems to be a ROCK based
>> precisely on that
>> >> upstream Prometheus repository that you are
already monitoring
>> >>
>>
(https://github.com/canonical/prometheus-rock/blob/main/rockcraft.yaml#L19
<https://github.com/canonical/prometheus-rock/blob/main/rockcraft.yaml#L19>).
>> >>
>> >> Can we then add this image to your list of
tracked ROCKs?
>> >>
>> >>
>> >> On Tue, May 30, 2023 at 9:45 PM Emilia Torino
>> >> <emilia.torino@xxxxxxxxxxxxx
>> <mailto:emilia.torino@xxxxxxxxxxxxx>> wrote:
>> >>
>> >> Hey all,
>> >>
>> >> On 30/5/23 13:14, Emilia Torino wrote:
>> >> > Hi Cristovao,
>> >> >
>> >> > On 30/5/23 09:41, Cristovao Cordeiro wrote:
>> >> >> Hi Emilia,
>> >> >>
>> >> >> could you please confirm the
`prometheus` container
>> image is being
>> >> >> monitored?
>> >> >
>> >> > I don't see prometheus being monitored by our
>> services (not as a
>> >> rock
>> >> > based on upstream source code nor as a
rock based on
>> debs). Does
>> >> this
>> >> > relate to a question being asked some
hours ago in
>> >> > ~Security
>> >>
>>
https://chat.canonical.com/canonical/pl/dchhoa7wxtyiper7rbk8h43mjo
<https://chat.canonical.com/canonical/pl/dchhoa7wxtyiper7rbk8h43mjo>?
>> >> >
>> >> >
>> >> > These emails' subject only mentions
cortex and
>> telegraf, but
>> >> >> I can see
"https://github.com/prometheus/prometheus
>> <https://github.com/prometheus/prometheus>
>> >> >> <https://github.com/prometheus/prometheus
>> <https://github.com/prometheus/prometheus>>" in
the body of the
>> >> email.
>> >> >
>> >> > Apologize for the confusion, this sounds
like a bug
>> in the email
>> >> content
>> >> > generator code. I will take a look at it
later.
>> >>
>> >> I investigated this bug and it should be solved
>> already. There was an
>> >> issue in the past, but we fixed it already.
I thought
>> it could be
>> >> related but I see this notification you are
asking is
>> from March.
>> >> If you
>> >> check the last notification sent on Thu,
May 4, 2:03 AM
>> is correctly
>> >> reporting about a single package (cortex only).
>> >>
>> >> Let me know if you have any further question.
>> >>
>> >> In this case, only a new
>> >> > CVE affecting consul has been created in
our tracker
>> >> >
>> >>
>>
https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2023-0845
<https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2023-0845>.
>> >> >
>> >> > Still, this does not mean cortex and
telegraf are
>> affected,
>> >> since this
>> >> > needs triage (i.e. understand if the
code/version
>> present in the
>> >> rocks
>> >> > are indeed vulnerable).
>> >> >
>> >> > FYI the reason why
>> https://github.com/prometheus/prometheus
>> <https://github.com/prometheus/prometheus> (and
>> >> also
>> >> > https://github.com/gogo/protobuf
>> <https://github.com/gogo/protobuf>) are listed in
this email, is
>> >> because
>> >> > these 3 are the *only* upstream projects
we are
>> monitoring
>> >> (because of
>> >> > the bug the 3 are incorrectly listed in
the email,
>> only consul
>> >> should
>> >> > be). In other words, we are not scanning
every
>> upstream source
>> >> project
>> >> > which is used to build cortex and telegraf.
>> >> >
>> >> > There are reasons why this service is
very limited,
>> and I hope this
>> >> > is/was clear. Let me know if you need
more information.
>> >> >
>> >> > Emilia
>> >> >
>> >> >
>> >> >>
>> >> >> ---------- Forwarded message ---------
>> >> >> From:
<security-team-toolbox-bot@xxxxxxxxxxxxx
>> <mailto:security-team-toolbox-bot@xxxxxxxxxxxxx>
>> >> >>
<mailto:security-team-toolbox-bot@xxxxxxxxxxxxx
>> <mailto:security-team-toolbox-bot@xxxxxxxxxxxxx>>>
>> >> >> Date: Sat, Mar 11, 2023 at 6:03 AM
>> >> >> Subject: [Ubuntu-docker-images] CVEs
potentially
>> affecting
>> >> cortex and
>> >> >> telegraf
>> >> >> To:
<ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx
>> <mailto:ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx>
>> >> >>
<mailto:ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx
>> <mailto:ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx>>>,
>> >> >> <sergio.durigan@xxxxxxxxxxxxx
>> <mailto:sergio.durigan@xxxxxxxxxxxxx>
>> >> <mailto:sergio.durigan@xxxxxxxxxxxxx
>> <mailto:sergio.durigan@xxxxxxxxxxxxx>>>,
>> >> >> <emilia.torino@xxxxxxxxxxxxx
>> <mailto:emilia.torino@xxxxxxxxxxxxx>
>> >> <mailto:emilia.torino@xxxxxxxxxxxxx
>> <mailto:emilia.torino@xxxxxxxxxxxxx>>>,
>> >> >> <alex.murray@xxxxxxxxxxxxx
>> <mailto:alex.murray@xxxxxxxxxxxxx>
>> <mailto:alex.murray@xxxxxxxxxxxxx
>> <mailto:alex.murray@xxxxxxxxxxxxx>>>,
>> >> >> <simon.aronsson@xxxxxxxxxxxxx
>> <mailto:simon.aronsson@xxxxxxxxxxxxx>
>> >> <mailto:simon.aronsson@xxxxxxxxxxxxx
>> <mailto:simon.aronsson@xxxxxxxxxxxxx>>>,
>> >> >> <dylan.stephano-shachter@xxxxxxxxxxxxx
>> <mailto:dylan.stephano-shachter@xxxxxxxxxxxxx>
>> >> >>
<mailto:dylan.stephano-shachter@xxxxxxxxxxxxx
>> <mailto:dylan.stephano-shachter@xxxxxxxxxxxxx>>>
>> >> >>
>> >> >>
>> >> >> New CVEs affecting packages used to
build upstream
>> based rocks
>> >> have been
>> >> >> created in the Ubuntu CVE tracker:
>> >> >>
>> >> >> * https://github.com/gogo/protobuf
>> <https://github.com/gogo/protobuf>
>> >> <https://github.com/gogo/protobuf
>> <https://github.com/gogo/protobuf>>:
>> >> >> * https://github.com/hashicorp/consul
>> <https://github.com/hashicorp/consul>
>> >> >> <https://github.com/hashicorp/consul
>> <https://github.com/hashicorp/consul>>: CVE-2023-0845
>> >> >> * https://github.com/prometheus/prometheus
>> <https://github.com/prometheus/prometheus>
>> >> >> <https://github.com/prometheus/prometheus
>> <https://github.com/prometheus/prometheus>>:
>> >> >>
>> >> >> Please review your rock to understand if
it is
>> affected by
>> >> these CVEs.
>> >> >>
>> >> >> Thank you for your rock and for
attending to this
>> matter.
>> >> >>
>> >> >> References:
>> >> >>
>> >>
>>
https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2023-0845
<https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2023-0845>
>> >> >>
>> >>
>>
<https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2023-0845
<https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2023-0845>>
>> >> >>
>> >> >>
>> >> >>
>> >> >> --
>> >> >> Mailing list:
>> https://launchpad.net/~ubuntu-docker-images
>> <https://launchpad.net/~ubuntu-docker-images>
>> >> >> <https://launchpad.net/~ubuntu-docker-images
>> <https://launchpad.net/~ubuntu-docker-images>>
>> >> >> Post to :
>> ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx
>> <mailto:ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx>
>> >> >>
<mailto:ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx
>> <mailto:ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx>>
>> >> >> Unsubscribe :
>> https://launchpad.net/~ubuntu-docker-images
>> <https://launchpad.net/~ubuntu-docker-images>
>> >> >> <https://launchpad.net/~ubuntu-docker-images
>> <https://launchpad.net/~ubuntu-docker-images>>
>> >> >> More help :
https://help.launchpad.net/ListHelp
>> <https://help.launchpad.net/ListHelp>
>> >> >> <https://help.launchpad.net/ListHelp
>> <https://help.launchpad.net/ListHelp>>
>> >> >>
>> >> >>
>> >> >> --
>> >> >> Cris
>> >>
>> >>
>> >>
>> >> --
>> >> Cris
>>
>>
>>
>> --
>> Cris
> ____
>
>
>
> --
> Cris
