Create guidance on triaging build time dependency vulnerabilities

[PushkarJ]

Description: Vulnerability scanners detect CVEs in build time dependencies. But, Best practices to triage these vulnerabilities are unclear

Impact: Adding docs based on experiences and anecdotes, that many projects can follow would be useful

Scope: Write best practices with examples like:

• Focus on highest severity CVEs first
• Document if not exploitable as a security advisory or github issue
• Patch when exploitable and fixed by upstream dependency
• Define roles and responsibilities

Meeting minutes where this was discussed: https://docs.google.com/document/d/170y5biX9k95hYRwprITprG6Mc9xD5glVn-4mB2Jmi2g/edit#heading=h.bssmkroi6sff and youtube recording: https://www.youtube.com/watch?v=MBHdvYW6YjI

cc @anvega @lumjjb @fkautz @ionut-arm

[fkautz]

Also make sure the time of the attestation is present. New information may change outcomes of the process.

[ionut-arm]

I'll try to write-up my notes and thoughts on this, I'm currently digging a bit deeper in the Rust ecosystem for this.

[lumjjb]

This could become a document to put under https://github.com/cncf/tag-security/tree/main/project-resources!

[fkautz]

Would love to see what you come up with. As the ecosystem evolves, I’ll add guidance on SBOM integration with CVEs and VEX.

On Mon, Feb 7, 2022 at 7:21 AM Brandon Lum ***@***.***> wrote: This could become a document to put under https://github.com/cncf/tag-security/tree/main/project-resources! — Reply to this email directly, view it on GitHub <#855 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABBEGSA76UMYMNZ5LKG3RTUZ7PPRANCNFSM5NM4AXAQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- -- Frederick F. Kautz IV

[ionut-arm]

Hi all, apologies for the long delay. I've made a markdown version with some guidance on build-time dependency vulnerabilities available here. Feel free to comment/modify as you please. It's fairly short, I wasn't sure just how much to go into detail and where.

[lumjjb]

This is awesome @ionut-arm! Would you like to create a PR for this to the repo? This is definitely something the community at large can benefit from! Would be easier to get comments too!

[ionut-arm]

Alright, I have finally opened that PR, many apologies for the delay

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[anvega]

#887 merged