Skip to content

security-advisories.md

Latest commit

 

History

History
84 lines (64 loc) · 3.7 KB

security-advisories.md

File metadata and controls

84 lines (64 loc) · 3.7 KB
Raw
title Security Advisories
tags
Security
sidebar_position 2
description How %%te%% publishes security advisories, emergency releases and safety guidance

Once a vulnerability has been fixed, or once a mitigation is available, the %%te%% project informs its users through two complementary channels: a GitHub security advisory, which is the authoritative and machine-readable record, and an announcement in the Tech Community, which reaches users who do not follow the repository.

GitHub security advisories

Advisories are published on the security advisories page of the %%te%% repository.

Each advisory states:

  • a description of the vulnerability and of its impact,
  • the affected versions and the version in which the problem is fixed,
  • a severity rating,
  • any workaround which can be applied when upgrading is not immediately possible,
  • credit to the reporter, unless they asked to stay anonymous.

Where appropriate, a CVE identifier is requested through GitHub when the advisory is published.

:::note %%te%% is distributed as Linux packages and container images, and not through a package registry which vulnerability scanners index. Do not rely on a tool such as Dependabot to tell you that an advisory applies to your devices: subscribe to one of the channels described below instead. :::

Announcements in the Tech Community

Security announcements are published in the Tech Community under the tedge-security tag.

This tag is used for all the notifications which require the attention of an operator, and not only for advisories:

  • Security advisories, linking to the corresponding GitHub advisory and to the release containing the fix.
  • Emergency releases, when a release is published outside of the regular release cycle.
  • Safety guidance, such as a recommended configuration change, a workaround for an unfixed problem, or a warning about an insecure usage pattern.

To be notified, open the tedge-security tag while logged in to the Tech Community, and watch it.

:::note A Tech Community announcement never replaces the advisory. When the two differ, the GitHub advisory is the reference. :::

Emergency releases

A fix for a vulnerability is released as a patch release, published through the same channels as any other release: the GitHub releases page, the Cloudsmith package repositories and the container images. See Installation for the details of each channel.

An emergency release is a patch release which is published outside of the regular release cycle, because the severity of the problem does not allow waiting for the next planned release. Such a release contains the security fix and as few unrelated changes as possible, so that it can be adopted quickly and with a low risk of regression.

Emergency releases are announced under the tedge-security tag, with a description of the problem, the affected versions and the upgrade path.

Staying informed

You are recommended to use at least one of the following:

  • Watch the tedge-security tag in the Tech Community.
  • Watch the %%te%% repository on GitHub, selecting Custom → Releases, to be notified of every new release, including the ones which contain a security fix.
  • Track the versions of %%te%% which are deployed on your devices, so that you can determine quickly whether an advisory applies to your fleet.