From 80fc6f93d9e33c215b4b32f8a5e21f9fa96dafba Mon Sep 17 00:00:00 2001 From: GuangmingLuo Date: Fri, 22 May 2026 15:06:39 +0800 Subject: [PATCH] Remove security page --- assets/js/security.js | 110 ---------------- content/en/security/_index.md | 12 -- .../en/security/safety-bulletin/_index.html | 86 ------------ .../security/safety-bulletin/detail/_index.md | 5 - .../detail/cloudwego-sa-2022-1/index.md | 34 ----- .../detail/cloudwego-sa-2022-2/index.md | 44 ------- .../vulnerability-reporting/_index.html | 122 ------------------ content/zh/security/_index.md | 12 -- .../zh/security/safety-bulletin/_index.html | 86 ------------ .../security/safety-bulletin/detail/_index.md | 5 - .../detail/cloudwego-sa-2022-1/index.md | 34 ----- .../detail/cloudwego-sa-2022-2/index.md | 43 ------ .../vulnerability-reporting/_index.html | 113 ---------------- layouts/404.html | 2 +- layouts/partials/scripts.html | 3 +- layouts/security/baseof.html | 34 ----- layouts/security/baseof.print.html | 28 ---- layouts/security/list.html | 32 ----- layouts/security/list.print.html | 3 - layouts/security/single.html | 3 - static/img/security/procedure_zh.png | Bin 175506 -> 0 bytes static/img/security/report-banner.png | Bin 143508 -> 0 bytes 22 files changed, 2 insertions(+), 809 deletions(-) delete mode 100644 assets/js/security.js delete mode 100644 content/en/security/_index.md delete mode 100644 content/en/security/safety-bulletin/_index.html delete mode 100644 content/en/security/safety-bulletin/detail/_index.md delete mode 100644 content/en/security/safety-bulletin/detail/cloudwego-sa-2022-1/index.md delete mode 100644 content/en/security/safety-bulletin/detail/cloudwego-sa-2022-2/index.md delete mode 100644 content/en/security/vulnerability-reporting/_index.html delete mode 100644 content/zh/security/_index.md delete mode 100644 content/zh/security/safety-bulletin/_index.html delete mode 100644 content/zh/security/safety-bulletin/detail/_index.md delete mode 100644 content/zh/security/safety-bulletin/detail/cloudwego-sa-2022-1/index.md delete mode 100644 content/zh/security/safety-bulletin/detail/cloudwego-sa-2022-2/index.md delete mode 100644 content/zh/security/vulnerability-reporting/_index.html delete mode 100644 layouts/security/baseof.html delete mode 100644 layouts/security/baseof.print.html delete mode 100644 layouts/security/list.html delete mode 100644 layouts/security/list.print.html delete mode 100644 layouts/security/single.html delete mode 100644 static/img/security/procedure_zh.png delete mode 100644 static/img/security/report-banner.png diff --git a/assets/js/security.js b/assets/js/security.js deleted file mode 100644 index aabe17468e0..00000000000 --- a/assets/js/security.js +++ /dev/null @@ -1,110 +0,0 @@ -/* -Copyright 2018 Google LLC - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - https://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ -(function($){ - $.safetyData = [{ - id: 1, - bulletin: 'CloudWeGo-SA-2022-1', - digest: 'Connection Leaking', - influence: ['kitex-v0.1.3'], - level: 'Low', - publish: '2022-01-13' - },{ - id: 2, - bulletin: 'CloudWeGo-SA-2022-2', - digest: 'Netpoll Panic', - influence: ['netpoll-v0.2.2', 'kitex-v0.3.0'], - level: 'Middle', - publish: '2022-05-09' - }]; -})(jQuery); - -(function($) { - 'use strict'; - function renderSafetyTable($, data) { - const $tbody = $('#bulletinTable > tbody'); - const isCN = location.href.indexOf('zh') > -1 ? '/zh' : ''; - let html = ''; - if (data.length === 0) { - $tbody.html(' '); - return; - } - for(let i =0;i< data.length;i++){ - const item = data[i]; - const bulletinList = [ - ''+ item.bulletin + '', - ''+ item.digest + '', - ''+ item.level + '', - ''+ item.influence.join('
') + '', - ''+ item.publish + '', - ].join('\n'); - html+= bulletinList; - } - $tbody.html(html); - } - - function filterData(source, keyword, level, year) { - const compose = (arr) => { - return arr.reduce( - (prev, next) => - (...args) => - prev(next(...args)), - ); - }; - const rules = { - getAll: (data) => data, - getWord: (data) => data.filter((item)=> { - return item.bulletin.indexOf(keyword) > -1 || (item.digest.indexOf(keyword)) > -1 || (item.influence.join('').indexOf(keyword)) > -1; - }), - getLevel: (data) => data.filter((item)=> item.level.toLowerCase() === level), - getYear: (data) => data.filter((item)=> item.publish.indexOf(year) >-1), - } - const { getAll, getWord, getLevel, getYear } = rules; - const filtrateList = [ - keyword === '' ? getAll : getWord, - level === 'all' ? getAll : getLevel, - year === 'all' ? getAll : getYear, - ]; - return compose([...filtrateList])(source); - } - - function filterEvent($, data){ - let keyword = ''; - let level = 'all'; - let year = 'all'; - - $(document).on('blur', '#safetyBulletinSearch', function(e) { - e.preventDefault(); - keyword = $(e.target).val().trim(); - const result = filterData(data, keyword, level, year); - renderSafetyTable($, result); - }); - - $(document).on('click', '[name^="safetyBtn"]', function(e){ - level = $(e.target).val(); - const result = filterData(data, keyword, level, year); - renderSafetyTable($, result); - }); - - $(document).on('change', '#yearSelect', function(e){ - year = $(e.target).val(); - const result = filterData(data, keyword, level, year); - renderSafetyTable($, result); - }); - } - // control event - renderSafetyTable($, $.safetyData); - filterEvent($, $.safetyData); -}(jQuery)); diff --git a/content/en/security/_index.md b/content/en/security/_index.md deleted file mode 100644 index 0c704aec1f4..00000000000 --- a/content/en/security/_index.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: "Security" -linkTitle: "Security" -isFolder: true -menu: - main: - weight: 50 ---- - -This is the **security** section. It has two categories: vulnerability-reporting and safety-bulletin. - -Files in these directories will be listed in reverse chronological order. diff --git a/content/en/security/safety-bulletin/_index.html b/content/en/security/safety-bulletin/_index.html deleted file mode 100644 index d7a3fe30606..00000000000 --- a/content/en/security/safety-bulletin/_index.html +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: 'safety-bulletin' -linkTitle: 'safety-bulletin' -weight: 1 -menu: - main: - weight: 1 - parent: 'Security' ---- - -
-
-
-
- - -
-
- -
-
- - - - - - - - - - - - - - -
-
-
-
- - -
-
-
- -
- - - - - - - - - - - - -
BulletinDigestLevelInfluencePublish
- - - -
-
diff --git a/content/en/security/safety-bulletin/detail/_index.md b/content/en/security/safety-bulletin/detail/_index.md deleted file mode 100644 index 939a927e2ed..00000000000 --- a/content/en/security/safety-bulletin/detail/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "detail" -linkTitle: "detail" -weight: 1 ---- diff --git a/content/en/security/safety-bulletin/detail/cloudwego-sa-2022-1/index.md b/content/en/security/safety-bulletin/detail/cloudwego-sa-2022-1/index.md deleted file mode 100644 index 531f53cce57..00000000000 --- a/content/en/security/safety-bulletin/detail/cloudwego-sa-2022-1/index.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -date: 2022-01-13 -title: "CloudWeGo-SA-2022-1" -linkTitle: "CloudWeGo-SA-2022-1" -description: "Connection Leaking" ---- - -## Overview - -Fixed connection leak when client encoding failed - -## Severity Level - -Low - -## Description - -Fixed connection leak when client encoding failed - -## Solution - -When client encoding fails, the connection is released - -## Affected Components - -kitex-v0.1.3 - -## CVE - -None - -## References - -- https://github.com/cloudwego/kitex/pull/315 diff --git a/content/en/security/safety-bulletin/detail/cloudwego-sa-2022-2/index.md b/content/en/security/safety-bulletin/detail/cloudwego-sa-2022-2/index.md deleted file mode 100644 index 9ed121ae4ba..00000000000 --- a/content/en/security/safety-bulletin/detail/cloudwego-sa-2022-2/index.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -date: 2022-05-09 -title: "CloudWeGo-SA-2022-1" -linkTitle: "CloudWeGo-SA-2022-1" -description: Netpoll Panic ---- - -## Overview - -Fixed Panic when "peer Close & local user Close" occurs simultaneously - -## Severity Level - -Middle - -## Description - -Fixed concurrency issues in extreme scenarios. - -Scenario: "peer Close & local user Close" occurs at the same time, and `ctx.onClose` executes `lock(user)`, and Poller also executes `p.detaches` (all three conditions are met) - -When two goroutines execute `op.Control(PollDetach)` at the same time, `op.unused` will be executed twice. - -When the program is idle, it is possible that `ctx.onclose` has completed the `close` callback, `freeop` has been reused, and the state becomes `inuse` again. -That's when the `op.unused` in `p.detaches` is executed; This will incorrectly set the operator of a new connection to 0, causing all subsequent `op.do` to fail in an infinite loop. - -## Solution - -`Poller` no longer executes `detach` asynchronously to ensure that it does not run concurrently with `ctx.onclose` and the changes are performance-neutral. - -## Affected Components - -netpoll-v0.2.2 - -kitex-v0.3.0 - -## CVE - -None - -## References - -- https://github.com/cloudwego/netpoll/issues/149 -- https://github.com/cloudwego/netpoll/pull/142 diff --git a/content/en/security/vulnerability-reporting/_index.html b/content/en/security/vulnerability-reporting/_index.html deleted file mode 100644 index a369649b1e1..00000000000 --- a/content/en/security/vulnerability-reporting/_index.html +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: 'vulnerability-reporting' -linkTitle: 'vulnerability-reporting' -weight: 2 -menu: - main: - weight: 2 - parent: 'Security' - ---- - -
-
- -
-
-

- # - Vulnerability Response -

-

- The CloudWeGo community places a high emphasis on the security of our community editions. The CloudWeGo Security Committee is dedicated to receiving, investigating, and disclosing security breaches related to the CloudWeGo community. - We actively encourage researchers and industry organizations to report any potential security vulnerabilities to our committee. Upon report, we pledge a prompt response, analysis, and resolution of the security concerns.

- -

# Supported Versions

-

Our vulnerability response process mainly supports the latest versions of the CloudWeGo community's sub-projects. If you have not yet upgraded, please do so as soon as possible.

- -

# Vulnerability Handling Process

-

Every security vulnerability is addressed by assigned team members who track, handle, and manage the repair and disclosure of vulnerabilities. - The process coordinator, a member of the CloudWeGo Security Committee, is responsible for the tracking and promotion of vulnerability fixes and disclosures.

- -

This image details the process involving vulnerability reporting, assessment, and disclosure.

- -

# Vulnerability Report

-

If you identify a potential security vulnerability in any CloudWeGo release, we strongly encourage you to submit a vulnerability report to the CloudWeGo community. We look forward to your cooperation in responsibly resolving and disclosing the issue.

-

# Reporting Methods

-

The CloudWeGo security team can be informed of potential security vulnerabilities in CloudWeGo releases via email at（security@cloudwego.io）. -

-

# Reporting Methods

-

For swift confirmation and verification of suspected vulnerabilities, we ask that your email includes the following:

-
    -

  • Basic information: This includes details on the vulnerability's affected modules, trigger conditions, and potential system failures after successful exploitation.

    • -

  • Technical details: information on system configuration, location methods, exploit descriptions, proof-of-concept (POC), problem reproduction method, and steps.

    • -

  • Suggested solutions for repair.

    • -

  • Your organization and contact details.

    • -

  • Your potential disclosure plans for vulnerabilities.

    • -
-

# Email Response Time

-

We will respond within 48 hours to suspected security vulnerabilities reported via email and provide feedback on the progress of vulnerability handling.

- -

# Vulnerability Severity Assessment

-

- CloudWeGo uses the industry-standard Common Vulnerability Scoring System (CVSS) for vulnerability assessments. Severity assessments categorize the difficulty of exploiting vulnerabilities and the potential impact on confidentiality, integrity, and availability after successful exploitation.

-

# Assessment Criteria

-

CloudWeGo uses CVSSv3 for vulnerability assessments. The assessments measure the impact of a vulnerability using different metrics such as:

-
    -

  • Attack vector (AV) - Indicates the "remoteness" of the attack and how to exploit this vulnerability.

    • -

  • Attack complexity (AC) - Tells the difficulty of attack execution and the factors needed for a successful attack.

    • -

  • User interaction (UI) - Determines whether the attack requires user participation.

    • -

  • Privileges required (PR) - Records the level of user authentication required for a successful attack.

    • -

  • Scope (S) - Determines whether the attacker can affect components with different permission levels.

    • -

  • Confidentiality (C) - Measures the extent of the impact after the information is disclosed to unauthorized parties.

    • -

  • Integrity (I) - Measures the extent of the impact after the information is tampered with.

    • -

  • Availability (A) - Measures the extent to which users are affected when they need to access data or services.

    • -
-

# Assessment Principles

-

The assessment provides an insight into the severity of a vulnerability, not the risk. Every security vulnerability has multiple attack scenarios; the highest CVSS score scenario is used as the basis for the vulnerability assessment:

-
    -

  • The assessment must be based on the attack scenario and ensures that the attacker can cause an impact on the system's confidentiality, integrity, and availability in this scenario.

    • -

  • When a security vulnerability has multiple attack scenarios, the one that causes the greatest impact, that is, the highest CVSS score, should be used as the basis.

    • -

  • If a vulnerability exists in the library being invoked, it should be assessed after determining the attack scenario of the vulnerability based on the use of the library in the product.

    • -

  • Security defects that cannot be triggered or do not affect CIA (Confidentiality/Integrity/Availability) are given a CVSS score of 0.

    • -
-

# Assessment Steps

-

When assessing vulnerabilities, you can proceed in the following steps:

-
    -

  • Set possible attack scenarios and score based on these scenarios.

    • -

  • Determine the vulnerable component and the impact (affected) component.

    • -

  • Choose the value of the basic assessment indicators: Provide a vulnerability impact evaluation by scoring the exploitable indicators (attack vectors/attack complexity/required privileges/user interaction/scope) and affected indicators (confidentiality/integrity/availability).

    • -
-

# Severity Classification

- - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity RatingCVSS Score
Critical9.0 - 10.0
High7.0 - 8.9
Medium4.0 - 6.9
Low0.1 - 3.9
None0.0
- -

# Vulnerability Disclosure

-

- To ensure the safety of CloudWeGo users, the community won't disclose, discuss, or confirm the security issues of any version before an investigation, security repairs, and the issuance of security notices is completed. - Once the security vulnerability is rectified, the CloudWeGo community will release a security notice inclusive of the technical details of this vulnerability, the CVE number, CVSS security score, and severity rating. This will also include the versions affected by this vulnerability and the fixed versions. -

-
-
diff --git a/content/zh/security/_index.md b/content/zh/security/_index.md deleted file mode 100644 index af09755b941..00000000000 --- a/content/zh/security/_index.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: 安全 -linkTitle: 安全 -isFolder: true -menu: - main: - weight: 50 ---- - -This is the **security** section. It has two categories: vulnerability-reporting and safety-bulletin. - -Files in these directories will be listed in reverse chronological order. diff --git a/content/zh/security/safety-bulletin/_index.html b/content/zh/security/safety-bulletin/_index.html deleted file mode 100644 index d233844b1f5..00000000000 --- a/content/zh/security/safety-bulletin/_index.html +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: '安全公告' -linkTitle: '安全公告' -weight: 1 -menu: - main: - weight: 1 - parent: '安全' ---- - -
-
-
-
- - -
-
- -
-
- - - - - - - - - - - - - - -
-
-
-
- - -
-
-
- -
- - - - - - - - - - - - -
公告摘要严重级别影响组件与版本发布时间
- - - -
-
diff --git a/content/zh/security/safety-bulletin/detail/_index.md b/content/zh/security/safety-bulletin/detail/_index.md deleted file mode 100644 index 61cfa0722a2..00000000000 --- a/content/zh/security/safety-bulletin/detail/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "公告详情" -linkTitle: "公告详情" -weight: 1 ---- diff --git a/content/zh/security/safety-bulletin/detail/cloudwego-sa-2022-1/index.md b/content/zh/security/safety-bulletin/detail/cloudwego-sa-2022-1/index.md deleted file mode 100644 index b012f61184f..00000000000 --- a/content/zh/security/safety-bulletin/detail/cloudwego-sa-2022-1/index.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -date: 2022-01-13 -title: "CloudWeGo-SA-2022-1" -linkTitle: "CloudWeGo-SA-2022-1" -description: "Connection Leaking" ---- - -## 简介 - -修复客户端编码失败时连接会泄漏的问题 - -## 严重级别 - -Low - -## 描述 - -修复客户端编码失败时连接会泄漏的问题 - -## 解决办法 - -当客户端编码失败时，释放连接 - -## 影响组件 - -kitex-v0.1.3 - -## CVE - -无 - -## 参考链接 - -- https://github.com/cloudwego/kitex/pull/315 diff --git a/content/zh/security/safety-bulletin/detail/cloudwego-sa-2022-2/index.md b/content/zh/security/safety-bulletin/detail/cloudwego-sa-2022-2/index.md deleted file mode 100644 index bce23e40ed2..00000000000 --- a/content/zh/security/safety-bulletin/detail/cloudwego-sa-2022-2/index.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -date: 2022-05-09 -title: "CloudWeGo-SA-2022-2" -linkTitle: "CloudWeGo-SA-2022-2" -description: Netpoll Panic ---- - -## 简介 - -修复当“对端关闭 & 本端 user Close” 同时发生时出现 Panic 的问题 - -## 严重级别 - -Middle - -## 描述 - -修复极端场景下的并发问题： - -场景：“对端关闭 & 本端 user Close” 同时发生，并且 c.onClose 执行的是 lock(User)，同时 poller 也执行到了 p.detaches (三个条件同时满足) - -这时候会有两个 goroutine 同时执行 op.Control(PollDetach)，因此 op.unused 会被执行两次。 - -当程序比较闲时，有可能 c.onClose 已经执行完 close callback 了，freeop 并且已经被复用，又变成 inuse 状态；而这时候 p.detaches 里的 op.unused 才开始执行；这样就会把一个新连接的 operator 错误的置成 0 ，导致后续的 op.do 全失败，变成死循环。 - -## 解决办法 - -poller 不再异步执行 detach，以保证不会和 c.onClose 并发，改动是性能无损的。 - -## 影响组件 - -netpoll-v0.2.2 - -kitex-v0.3.0 - -## CVE - -无 - -## 参考链接 - -- https://github.com/cloudwego/netpoll/issues/149 -- https://github.com/cloudwego/netpoll/pull/142 diff --git a/content/zh/security/vulnerability-reporting/_index.html b/content/zh/security/vulnerability-reporting/_index.html deleted file mode 100644 index 4d722c0e3b1..00000000000 --- a/content/zh/security/vulnerability-reporting/_index.html +++ /dev/null @@ -1,113 +0,0 @@ ---- -title: 漏洞管理 -linkTitle: '漏洞管理' -weight: 2 -menu: - main: - weight: 2 - parent: '安全' ---- - -
-
- -
-
-

- # - 漏洞响应 -

-

- CloudWeGo 社区非常重视社区版本的安全性，CloudWeGo 安全委员会负责接收、调查和披露 CloudWeGo 社区相关的安全漏洞。我们鼓励漏洞研究人员和行业组织主动将 CloudWeGo 社区的疑似安全漏洞报告给 CloudWeGo 社区安全委员会。我们会快速的响应、分析和解决上报的安全问题或安全漏洞。

-

# 支持版本

-

漏洞响应流程主要支持 CloudWeGo 社区各个子项目的最新版本，如果您还没有升级请尽快升级。

-

# 漏洞处理流程

-

每个一个安全漏洞都会有一个指定的人员进行跟踪和处理，协调员是 CloudWeGo 安全委员会的成员，他将负责跟踪和推动漏洞的修复和披露。漏洞端到端的处理流程如下图。

- -

在这里我们主要介绍流程中漏洞上报、漏洞评估和漏洞披露这三部分内容。

-

# 漏洞上报

-

如果您认为 CloudWeGo 产品存在一个疑似安全漏洞，我们希望您将漏洞上报给 CloudWeGo 社区，并与我们配合以负责任的方式修复和披露该问题。

-

# 漏洞上报方式

-

您可以通过 email 将 CloudWeGo 产品的潜在安全漏洞发送到 CloudWeGo 安全团队邮箱（security@cloudwego.io）。 -

-

# 漏洞上报内容

-

为了便于快速的确认和验证疑似漏洞，请在漏洞上报邮件中包含但不限于以下内容：

-
    -

  • 基本信息：包括漏洞影响的模块、漏洞的触发条件和成功利用后对系统的影响等。

    • -

  • 技术细节：包括系统配置、定位方法、Exploit 的描述、POC、问题重现方法和步骤等。

    • -

  • 修复方案建议。

    • -

  • 上报者的组织和联系方式。

    • -

  • 上报者可能的漏洞披露计划。

    • -
-

# 邮件响应时间

-

我们将在48小时内响应通过邮箱上报的疑似安全漏洞，并向上报者反馈漏洞处理的进展。

-

# 漏洞严重性评估

-

- 业界普遍使用 CVSS 标准评估漏洞的严重性，CloudWeGo 在使用 CVSSv3 进行漏洞评估时，需要设定漏洞攻击场景，基于在该攻击场景下的实际影响进行评估。漏洞严重等级评估是指针对漏洞利用难易程度，以及利用后对机密性、完整性、可用性的影响进行评估，并生成一个评分值。

-

# 评估标准

-

CloudWeGo 社区采用 CVSS v3 对漏洞进行评估，CVSS V3 由通过对以下向量来评估一个漏洞的影响：

-
    -

  • 攻击向量（AV）-表示攻击的“远程性”以及如何利用此漏洞。

    • -

  • 攻击复杂性（AC）-讲述攻击执行的难度以及成功进行攻击需要哪些因素。

    • -

  • 用户交互（UI）-确定攻击是否需要用户参与。

    • -

  • 所需的权限（PR）-记录成功进行攻击所需的用户身份验证级别。

    • -

  • 范围（S）-确定攻击者是否可以影响具有不同权限级别的组件。

    • -

  • 机密性（C）-衡量信息泄露给非授权方后导致的影响程度。

    • -

  • 完整性（I）-衡量信息被篡改后导致的影响程度。

    • -

  • 可用性（A）-衡量用户在需要访问数据或服务时受影响的程度。

    • -
-

# 评估原则

-
    -

  • 评估漏洞的严重等级，不是评估风险。

    • -

  • 评估时必须基于攻击场景，且保证在该场景下，攻击者成功攻击后能对系统造成机密性、完整性、可用性影响。

    • -

  • 当安全漏洞有多个攻击场景时，应以造成最大的影响，即 CVSS 评分最高的攻击场景为依据。

    • -

  • 被嵌入调用的库存在漏洞，要根据该库在产品中的使用方式，确定漏洞的攻击场景后进行评估。

    • -

  • 安全缺陷不能被触发或不影响 CIA(机密性/完整性/可用性)，CVSS 评分为0分。

    • -
-

# 评估步骤

-

对漏洞进行评估时，可根据下述步骤进行操作：

-
    -

  • 设定可能的攻击场景，基于攻击场景评分。

    • -

  • 确定漏洞组件（Vulnerable Component）和受影响组件（Impact Component）。

    • -

  • 选择基础评估指标的值：通过对可利用指标（攻击向量/攻击复杂度/所需权限/用户交互/范围）和受影响指标（机密性/完整性/可用性）给出漏洞影响评估。

    • -
-

# 严重等级划分

- - - - - - - - - - - - - - - - - - - - - - - - - - - -
严重等级（Severity Rating）CVSS 评分（Score）
致命（Critical）9.0 - 10.0
高（High）7.0 - 8.9
中（Medium）4.0 - 6.9
低（Low）0.1 - 3.9
无（None）0.0
-

# 漏洞披露

-

- 为了保护 CloudWeGo 用户的安全，在进行调查、修复和发布安全公告之前，CloudWeGo 社区不会公开披露、讨论或确认 CloudWeGo 产品的安全问题。安全漏洞修复后 CloudWeGo 社区会发布安全公告，安全公告内容包括该漏洞的技术细节、CVE编号、CVSS安全评分、严重性等级以及受到该漏洞影响的版本和修复版本等信息。 -

-
-
diff --git a/layouts/404.html b/layouts/404.html index d0a7aedfa1e..2a9794af409 100644 --- a/layouts/404.html +++ b/layouts/404.html @@ -10,7 +10,7 @@

{{ T "error_page_title" }}

{{ T "error_404_were_you_looking_for" }}