From e18a865e4381ae74768f2344813b12a72d7f6781 Mon Sep 17 00:00:00 2001 From: Vincent Moutoussamy Date: Wed, 9 Sep 2026 13:29:47 +0200 Subject: [PATCH] Updates security policy with CVD --- SECURITY.md | 201 +++++++++++++++++++++++++++------------------------- 1 file changed, 104 insertions(+), 97 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 8ed31c1..5dfb840 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,129 +1,136 @@ # Security Policy -SUSE NeuVector is deeply committed to safeguarding the security of our products, and endeavors to resolve security issues in a timely manner. +At SUSE, we are deeply committed to maintaining the trust of our customers and the broader +open-source community. Open collaboration, transparency, and secure product development are +fundamental to our mission. -We extend our heartfelt thanks to the security researchers and users who diligently report vulnerabilities. Your invaluable contributions enhance our ability to improve our systems and protect our user community. +> [!IMPORTANT] +> Please refer to our company-wide +[SUSE Coordinated Vulnerability Disclosure ("CVD") Policy][CVD Policy], for more information. -We go through all reported security issues, reviewing them with the project's maintainers and coordinating the fixes and disclosures. We credit all accepted reports from users and security researchers in our [Security Advisories](https://github.com/neuvector/neuvector/security/advisories). +We go through all reported security issues, reviewing them with the project's maintainers and +coordinating the fixes and disclosures. We credit all accepted reports from users and security +researchers in our [Security Advisories][advisories]. -## Reporting a Vulnerability +## What SUSE considers a valid vulnerability > [!CAUTION] -> Do not attempt to test a possible vulnerability or an exploit on systems that you do not have an explicit authorization of its owner. +> Do not test potential exploits or vulnerabilities on any system without explicit authorization +from the system owner. -Please before reporting a vulnerability, make sure it impacts a [supported version](#supported-versions). +### Valid -### What types of issue to report +> [!WARNING] +> Reported vulnerabilities must affect a supported version of the SUSE Rancher ecosystem. Refer to +[SUSE Support Lifecycle][lifecycle] for current support status. -This reporting channel focuses on bugs with potential security impact on products within the NeuVector ecosystem. Example of valid reports: +Example of valid reports: -- XSS on NeuVector UI. -- Privilege escalation through NeuVector RBAC. +- XSS on Rancher Manager UI. +- Privilege escalation through Rancher Manager RBAC. If you are unsure, check the types of issues NOT to report below. -### What types of issue NOT to report +### Invalid -Some issues are outside of the scope of this channel, and therefore should not be reported: +Do NOT report the following via this channel: -- CVEs that were found by CVE scanners (e.g. Trivy, Snyk). Public CVEs do not need to be reported as they are fixed as part of the development process. -- Improvements or questions on the security hardening guides. These should be reported as a new [docs issue](https://github.com/neuvector/docs/issues/new/choose). -- Issues or bugs that aren't security related. These should be reported as a new [issue](https://github.com/neuvector/neuvector/issues/new/choose). -- Issues with mirrored container images, instead please report them via the security channels of the specific upstream project. -- Issues that are self inflicted and require the user to disable security features or downgrade the security of its environment in order for the vulnerability to be exploited. -- Issues that can only be exploited by the administrator itself (after all, the admin is already a privileged user and implicitly trusted). -- Issues regarding missing HTTP headers or exposure of versions in HTTP headers. -- Vulnerabilities affecting directly a user or customer environment. Such vulnerabilities must be reported directly to the affected user/customer. Be advised that such reports can constitute law infringement under certain jurisdictions. +- Public CVEs generated by automated scanners (e.g., Trivy, Snyk) as they are fixed as part of the +development process. +- Non-security bugs or documentation improvements. Report them via [issues in Rancher][rancher issue] or +[documentation issues][doc issue] issues. +- Self-inflicted issues requiring degraded security settings, or admin-only exploitation. -If going through all the examples above you are still in doubt, please go ahead and use this channel. After all, it's better be safe than sorry. +## Reporting Instructions and Mandatory Requirements -## Supported Versions +Submit reports via email to [psirt@suse.com](mailto:psirt@suse.com). We recommend OpenPGP encrypted +and signed email, please check the [section](#gpg-key---psirtsusecom) below for more details. -Please review our [support maintenance and terms](https://www.suse.com/lifecycle/) to view the current support lifecycle. - -## Reporting a Vulnerability - -To report a security vulnerability, email security-rancher@suse.com. You can optionally use the GPG key `rsa4096/C9DF50BDAC351DA9` for encrypted communication. - -We currently do not have a bounty rewards program in place, and nor do we offer swags. However, we genuinely appreciate the vigilance and expertise of our user community in helping us maintain the highest security standards. +### What information to provide -We strive to acknowledge receiving submissions within 5 working days, please wait until that time has past before asking for a status update. +> [!WARNING] +> The information below MUST be provided in order for the report to be timely and effectively +analyzed. -The information contained in your report must be treated as embargoed and must not be shared publicly, unless explicitly agreed with us first. This is to protect the NeuVector ecosystem users and enable us to follow through our coordinated disclosure process. The information shall be kept embargoed until a fix is released. +Reports that miss the required information might be considered AI generated spam or reviewed with a +lower priority. -### What information to provide +- **Product Name & Version**: Affected product and version, or GitHub source code link, if the issue +was observed in the source code. +- **Description**: Complete description of the vulnerability. +- **Impact**: Classification of issue type and potential impact when exploited. +- **Steps to Reproduce** Clear, step-by-step reproduction instructions or proof of concept (POC). -The information below must be provided in order for the report to be timely and -effectively analyzed. Reports that miss the required information might be -considered AI generated spam or reviewed with a lower priority. +> [!TIP] +> The more information you provide, the faster we will be able to reproduce the issue and address +your concerns more effectively. -- Product name and version where the issue was observed. If the issue was observed on the source code, the link to the specific code in GitHub instead. -- Description of the problem. -- Type of the issue and impact when exploited. -- Steps to reproduce. -- A valid proof of concept (POC) exploit (only on a valid system that you are - authorized to perform such proof). A working POC is now mandatory as a proof - of work (POW) to reduce the noise of AI generated low quality reports. -- It's mandatory to inform if AI tools were used to find the issue being - reported, to automate or to write the report, POC code or possible patch. If - this was the case, then inform which AI tools and models were used. +### GPG Key - `psirt@suse.com` -The more information you provide, the faster we will be able to reproduce the issue and address your concerns more effectively. +To ensure the integrity and confidentiality of our communications, we recommend that individuals +reaching out to the SUSE Product Security team utilize openPGP encryption. Note that while message +contents are protected, the email subject or the names of any attached files will be excluded from +encryption. -### GPG Key - `security-rancher@suse.com` +Our official public key is available here: +``` +pub ed25519/0xE0D1EF75DEBDFEE9 2026-09-01 [SC] [expires: 2037-09-01] +Key fingerprint = AB20 5CE3 088C 1F1B CE74 DC99 E0D1 EF75 DEBD FEE9 +uid [ full ] SUSE Product Security Incident Response Team psirt@suse.com +sub cv25519/0xA4B7B686CC4152BD 2026-09-01 [E] [expires: 2037-09-01] +Key fingerprint = B13E 46DE 87EB 81D5 15E1 1909 A4B7 B686 CC41 52BD +``` +The key is listed below in ASCII encoded form. ```pgp -----BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGHvxFcBEADibmTaKMTFbiMRAxtM5OjMOAjko7CovpnYSUOuRYi4IblFKIjL -P41oMBT+NgYEQh2//ktNAnAD/v83fkhjPZEM/Fo3yE6JdedCsHajZ2ryeuqEzs5F -c94UtTg8NQxrUgEe4Lk0tFdniGCt8BOb8spZIo9N87L2Zu3Z4P2vIjxdVGvXEQM8 -dr/+s4e973C6PXzXlIDeS3NE51aA0BSHHX72SwZWpvrNusW5fm0mFdLh1y6hNK16 -eNhXLwsA8RnvoOGS04DJCKxAlHQwUDRUDhPI6ULvN/RKm4mlf/qhNHvAntcJ9kiP -upFuPkHZxWAnLUyaWE+o8FhEVjHkaC9Abdyh33E6L252LKZvWszSiQSIJGXEa2TD -njume+jIMdoJN+g7m5NH7HszeKMF5YF0wek8ZvKBfJCxSn9EbUymNkDW5BwSnavQ -sukUawP89VLyXUd+hyd/e5IPMkYDvuHwqHlk60VWPKk7JC2M1LPCgqUsvyHaApQL -TFKHX6F6e0PnIkkU5VGhoSEBTT9B7vFYOMIvQSCavZadKTEZ0dNqd+bJWiLf3VYL -0srd9mPA6blO67EnuP6iuindzrZjQRGnjKkn7JCIoh0FG18kOnjw8dIu6UhCxu2m -V10xCbAMiEMAESuZr6iHG2y//UAYf7drPAGXcEqC+y51DxKcX6TPxNzkXwARAQAB -tDFTVVNFIFJhbmNoZXIgU2VjdXJpdHkgPHNlY3VyaXR5LXJhbmNoZXJAc3VzZS5j -b20+iQJSBBMBCAA8FiEEes5vtg3E4mxMbzRNyd9Qvaw1HakFAmHvxFcCGwMFCwkI -BwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEMnfUL2sNR2pDaYQAJuTbJVAVDWT -zGY2qbg5WSeniKWfS9EYkBD+7HIJWS8M3qOE6rC3plAWYOxs9imKLMJ/mg6dLb0Y -1EqofnqmNewd+QRouSwOG8smyjBubRXFQfSM7WLhid8DItnqK6a97ZoJ+TWB1tLQ -Nx6dkyrFRJS6uQtJxcA1ry6MazXduF7YKTmg7tjaV7Lc+RDReDLWMyk9YTlHFDSn -toKKxB0PxTHOVlhxkItDsxVhdhmfy5BSU9m703so7qnfKU5FEMBj9GwykJKdCtZV -pgk6BNONZkLNH9Mh2kVT2jUf8W/QxjKszHXJixhah6kfSKDaEwiwubP3Q5eVEWei -qzZSfHELXG/fi6yp2P25isttjRS1ovEScjMcgoGFFJjaXA2Rjm7/bMK1Ip1hJdDN -+In2PUuntqPlAFlsnD5bnq2l/uP4QDr/T8aLZxrpuNgKStZTpNrsk6XOOeEagQIO -+AVTIyE/DyHWO8LuX1lgj6aQHJSncbjMMMTdLwGFavliErsBuAhaHRqiuZXG8hLn -ggKkVw/t+pp3RPCuRkOEN/BjubbbIOb39SoWd5w/7X66pHQMxlS1vfy3GllGps9W -Oj0pSuuK1AOnExIdVdj1+9oR9NXABNNZkx1+GgZgIcoTrDWrm74DG9tkIp2OMuFM -ElnSEsmoDgz33ODc/PPx5CElN4zdp9r9uQINBGHvxFcBEADV5xofPXD5LoZN80nq -7DaRPxDm4sOXpI/29Yom+fYLtAetI4usMkBV/0+DoHyryPJoJFgIohGHmb3s5U3y -kEJb3ie+KignEQCI0TA0tUpc3d8R38JAFwzRi+yWakPp00a9lmSVUwD6bm6xG5U4 -arV4xcR12UdPzTSwDGjrt3oDEfpBO927mI5zaboLB7tmhSjwofgtcVsWJAZ28P7I -yD6E+EigxHgTEwT9nhAf42aIzp+NIl2gpdv7BOA3Akef5YhN0eFe8I3n0eyw4d3v -mp0fwjUgi26LYsCBdJR7VbIahjuLEJ7La2H5mNZUNGRCch3m5uSkAvYyMmrMQa0T -STUzzWwgftyqIYTijBMMWmoTRUsrKf6J975J8y92HzPxe3Rd/xJkiG6Dpv6bX2zp -monCoqOwTDihANFDp5xKcO8MvF5jNEIVy3OUqEeBVjL+7d03mFeej1YnBejOxwDs -vG+joSWEdwgBzkOnU5Uv2cBzs8XimgbR8dew//3DcHCqrrKQ8bVDN9ggKPDQsytv -toWaxi0hCPbM/XNh9eFKb/jEEmtYLTKN4UQVxQWZ2h2yrGPnIYzwWPc6n212pqdM -Pzy76xFLl6q8bYYBZ0whKZRr6SDgKOA+SA8XeSuShwnTlu49OFLmWeTNDnAIXbAk -ZsFnI/Sc9iLeLlq/C0NXDPwgxwARAQABiQI2BBgBCAAgFiEEes5vtg3E4mxMbzRN -yd9Qvaw1HakFAmHvxFcCGwwACgkQyd9Qvaw1HambBw/+Je2au+Tuqzk7Cmb3M9ri -re4/7H40GwWCerg0+7khBNM4qcRfJ/0cMnIwkT/U/8ezDY7Vvysmx8FalVDdERAT -ke6hVBIDBMq2EbhakEliHx8H0PZVvVXIe/ficZ48X167N6g44TG3LHagzbdniggy -V5P61Ktv1acXlKWgEJekOVn5AnA3PXupRHBbwXKWGlCnCqQiNJrQIgbz5lP+8DsF -+hb3YXVvQ48C2PBx1gOWRwaZ7eB7DLp7iGNYSvdBpyBW5mjaMoUHajvpM0cG+5Zg -D/brCWasbmaD7QulDCvi/JkTjA3BMgBAfuDTCC/buk+8QoAeREruRWPfF5IYqjD0 -x8xnkTFywz7HwX548kAbPftjZ3Fnwre5JWqkPWu7r15TPt+kHOPvt3mZIr4HNUye -QZG+RrN8rTYpHAYJm7Sc6Qt+Iilk6vp1hO/EBly2g/Er+IH/rykotmcbCvwqlITU -M9IVbqRcO0AEAD6QDBiswL1c2FxshAcjfab8zsbGP1UMhTo3RpddujvSiwenaeSK -WcUE3jFEJK6NjKRNzUjnudhesOUVysKex0ePmhL02wwVFTgxd0+Fa93AyEwVVlK7 -7deeeRAxLgvAMBI8N4+KkznAtyXwtVcWz4wIflznYr0ZW9kJZFepC/mQgUJs/A46 -ArCzVjxOM8JhL941OADyL1A= -=l4yT +mDMEapZ8VhYJKwYBBAHaRw8BAQdADoggNgBrXHimYH+7t5WVzBnhQmT8UPUIQQWH +pzLMaB+0PVNVU0UgUHJvZHVjdCBTZWN1cml0eSBJbmNpZGVudCBSZXNwb25zZSBU +ZWFtIDxwc2lydEBzdXNlLmNvbT6ImQQTFgoAQRYhBKsgXOMIjB8bznTcmeDR73Xe +vf7pBQJqlnxWAhsDBQkUsUK6BQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJ +EODR73Xevf7pRkMA/0XDeysUhC66NgiF7AVno+QBkyJso2pkbQQG3su+Oi9hAQCd +yy3iScttdmFKTqQr4N7redFAJ3Esw5vtxVzMHZhpCIkCMwQQAQgAHRYhBFzzxI6z +KP0xgVwUfZLb1rIpR3voBQJqlnyMAAoJEJLb1rIpR3voRUUP/0rHbb/m47zHc834 +G1CPaExiYOrtdckXNDwjno/r+2RppWy6ZxtM8KeLz+414NPxYUPNlyAvXd9pY3lW +sxQkDyJFrIJd0MDXiM8gDPyMuEB9k+yWeofJLcx6LfLvwJnFLwSSHcUWqmPcC6AI +TYVRhY6Gn9sNfJ5DnjQCxahZN55aGff2v0KiSPHrDqE59soLOQH7Vv2xuFVoWIYG +E8FZlzfIsfXJX0mBMrDxXO1+SGzDEdmcgLihhLHCcgmTCizz9S2qGLw3yaeI3NDB +xWafFrW80XGELXn+DdWP/khuU+PGfb0JcfroyR6GGNfAX5BC9O7yePGya+fZB8UD +puf93Q58Exu23KmQ00d0p2ey5t+KSFzmhk4knh6T50qEPm5Z04dwlzbnGwrn9qKS +iZuHn82Xx5B8eQ0nUN9jql1k/tjmeSXrhzfwoGhp4vCbz0AwAAglNo7pEb7j0xHF +C866ZCrQsQxVUcJCSox0HC27YZUvw2fvc57Lb+tkIxGi/AS0/Pe6lRHannqDzpwV +EW4WWIf6wE746M38q779p6PrH8Cu+aVWVCw+ZFNgv7GB/k0NeQUeliZ/xb40wKo4 +zwm6X8emOI/jkQ6fF9JCw7PXf+eFsy1CbB8sKCkFDkew1g9008lWnywxtx79c+Ks +tTMW5IlYQE5wWvLmPG87Sow9wHUSiQIzBBABCAAdFiEEXPPEjrMo/TGBXBR9ktvW +silHe+gFAmqWfLMACgkQktvWsilHe+h1Eg//bHdyPYiJPkKvsHf1guYD/OwEWm32 +1KlfKBKzpM1lZyyHjmNLetnytmypixiRvLuk1R4bTrn+AzwfvaJxqP1O3Ffm6Nub +npjhasBK1ehHL1KbN3ayiuOjjHEubj4ODtZd7QTjSLPNCgapL/N69lHoE6z7Hn+O +MSdy+tZdNKYmQSZdtxsLdzUsnbBItQS2X9Ow1Mwxnj2VHlmJ2WAz+RYh/npFbxc0 +jBDuGg8BIAQRovOym7zP3ubIMlWEbj0uEyNdoFh7qyBp/dC7cqMVykMJHMS2ywNJ +ic20wHZNioRkvRmBIfUS2LSSoSX75y5NWunm9umLZq9bveCCANtRnWA/OrWjM9Dv +bYgn3MUP50ppD8VhWg36jqWjQ4el4J+pZR+NnaqQb5EfFqk6LfHgcbEyBjvwx9EI +AxBTLUEsMCQh65O1tA8flp7EsnPNS5Gq43ceZ/2zqSN+nT6P9USrlvoaY7DycG3H +pW0ivUcILFem3Dv+hpOiu8l4fG34Sc+5iSsMP+3C4FF3b3zaT/OZVcrYz+9Lbel+ +wnttWiXAc1uY6g0BDBWfxqINMHTuqyI28kJpJwohIsAJupWiLBPJirbHxz3sCH1k +iTwKsQ9AQB6QG5kbTyI2XvMAoRS9sLJOIgj1XCQ5iPCnCqCW/5yUZXTLEE1hgDrP +4vNXGiDotSsrg1a4OARqlnxWEgorBgEEAZdVAQUBAQdAIK9oQ08e7coYwqNlcumv +kbxAtYZp/znHfF18qmaClEgDAQgHiH4EGBYKACYWIQSrIFzjCIwfG8503Jng0e91 +3r3+6QUCapZ8VgIbDAUJFLFCugAKCRDg0e913r3+6UnaAQCo9GLby0CgazcDlo91 +X99FhvSAKWmszQg/HXmFACe0IwD/Sv7t62yxGgGebbWdzfPbJOMdqo5ZPq8Yqzal +CNPwEwU= +=qfoM -----END PGP PUBLIC KEY BLOCK----- ``` +## SUSE Coordinated Vulnerability Disclosure ("CVD") Policy + +Please refer to our [SUSE Coordinated Vulnerability Disclosure ("CVD") Policy][CVD Policy], for more +information about our commitments and what you can expect after reporting a vulnerability, as +well as how to make an anonymous report and more. + + +[CVD Policy]: https://www.suse.com/support/security/cvd-policy/ +[advisories]: https://github.com/rancher/rancher/security/advisories +[doc issue]: https://github.com/rancher/rancher-docs/issues/new/choose +[rancher issue]: https://github.com/rancher/rancher/issues/new/choose +[lifecycle]: https://www.suse.com/lifecycle/ \ No newline at end of file