4 ms·

Perfect timing to ask a related question: We're building a complex software product and we want to offer support for it. As part of our contract we initially o

Perfect timing to ask a related question: We're building a complex software product and we want to offer support for it. As part of our contract we initially offered to work on all CVEs detected in one of our products or our dependencies (e.g. Docker images, Rust dependencies etc.) but we quickly learned that that's not feasible as there is a huge amount of low quality CVEs or irrelevant CVEs. We still need to take all of those into account and evaluate them. RedHat is using something similar where they have their own ratings which take the CVSS scores into account. They have a custom system built around this.[1] I'm wondering two things: 1) What would your expectations be towards a software vendor in terms of what issues to "fix"? 2) Is anyone aware of a security database & evaluation tool geared for vendors not for end-users? As in: Gets a feed of CVEs relevant for our products, each of them needs to be analyzed, amended, new CVSS vector and our own analyze result and then publish them to a feed, potentially emailing all affected customers [1] <https://access.redhat.com/security/updates/classification https://access.redhat.com/security/updates/classification>

X-Istence 3y ago
> 1. What would your expectations be towards a software vendor in terms of what issues to "fix"? This is difficult to answer, as it really depends on the customer. I work in a sector where any vulnerability is something that we have to attempt to remediate, even if it is a tool or library that is installed in a docker image that is not executable by the app that is running inside that container (think base image has a security flaw)... it means we have a lot of work to basically copy the contents of the app out of a container and plug it into our own base images that we can control/scan/deal with the vulnerabilities on. It's a giant pain in the behind. Vendors usually don't care because they rightfully so say "that library is not something our app uses, so it is out of scope" or "that comes installed by default in the debian base image from docker, complain to them". The field is simply too fast and large. The other one is when your binary/app is using a library that is vulnerable. Think Java/Go/Rust/Python/Ruby using a library that is vulnerable. We can't patch that (without potentially breaking things), so we have to get an exception while we push the vendor to upgrade. That part is even difficult at times though because sometimes the version that is not vulnerable is not API compatible with the version that is, and the upgrade takes longer than the time we have to remediate the vulnerability. With Ruby/Python/Java we can usually replace the bits necessary to make it not vulnerable and get an exception granted, but for Go/Rust and or other binaries we are stuck getting exception approval and building additional security around the product to make sure that exploit can't be attacked. > 2. Is anyone aware of a security database & evaluation tool geared for vendors not for end-users? As in: Gets a feed of CVEs relevant for our products, each of them needs to be analyzed, amended, new CVSS vector and our own analyze result and then publish them to a feed, potentially emailing all affected customers Even if you made this available, we HAVE to use the NVD/CVE scores themselves. We can't deviate just because the vendor says so, unfortunately. I would love for vendors to have something like this integrated though as some vendors have hopelessly outdated versions of libraries in their products because it is a lot of work for their teams to upgrade/test/validate that the new version doesn't break anything versus just sticking with the known quantity. Upgrading dependencies in a project is work, and the larger the project, the more dependencies, unless you have a really good testing framework it becomes a HUGE chore, and there is always some new feature that gets priority over gardening tasks.
- lars_francke 3y ago
  Thanks for the detailed response. Rebuilding the Docker images sounds painful! It is a minefield. Before starting our product company we did a lot of consulting gigs and security updates etc. were a big part of this. We have seen the other side of this for 10+ years and _want_ to do a good job but it's not actually easy to define what _good job_ means here. If you have any feedback for us what would make your life as a customer easier please do let me know (my E-Mail address is also in my profile)
wallrat 3y ago
DISCLOSURE: I'm working on commercial tooling for this exact problem [1] > 1) What would your expectations be towards a software vendor in terms of what issues to "fix"? I would want the vendor to communicate their analysis for all CVEs, i.e. letting us know which are exploitable or not, and what kind of response they are planning, or any fixes released. There are efforts to standardize this workflow with Vulnerability Disclosure Reports (VDRs)[2] and Vulnerability Exploitability eXchange VEXs[3]. Both these use cases are covered by OWASP CycloneDx[4]. > 2) Is anyone aware of a security database & evaluation tool geared for vendors not for end-users? IMHO, there are not any good tools available that solve the complete workflow. We are certainly aiming to fix that with[1], but it will take some time. [1] https://sbom.observer https://sbom.observer [2] https://www.cisa.gov/resources-tools/resources/minimum-requirements-vulnerability-exploitability-exchange-vex https://www.cisa.gov/resources-tools/resources/minimum-requi... [3] https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/f... [4] https://cyclonedx.org/capabilities/vex/ https://cyclonedx.org/capabilities/vex/
- lars_francke 3y ago
  Thank you. I haven't had time to dig into your tool yet but I did click the "Join Beta" link, unfortunately that doesn't do anything right now. Feel free to reach out to me via my e-mail from my profile if you're interested in Beta testers.

X-Istence 3y ago

> 1. What would your expectations be towards a software vendor in terms of what issues to "fix"? This is difficult to answer, as it really depends on the customer. I work in a sector where any vulnerability is something that we have to attempt to remediate, even if it is a tool or library that is installed in a docker image that is not executable by the app that is running inside that container (think base image has a security flaw)... it means we have a lot of work to basically copy the contents of the app out of a container and plug it into our own base images that we can control/scan/deal with the vulnerabilities on. It's a giant pain in the behind. Vendors usually don't care because they rightfully so say "that library is not something our app uses, so it is out of scope" or "that comes installed by default in the debian base image from docker, complain to them". The field is simply too fast and large. The other one is when your binary/app is using a library that is vulnerable. Think Java/Go/Rust/Python/Ruby using a library that is vulnerable. We can't patch that (without potentially breaking things), so we have to get an exception while we push the vendor to upgrade. That part is even difficult at times though because sometimes the version that is not vulnerable is not API compatible with the version that is, and the upgrade takes longer than the time we have to remediate the vulnerability. With Ruby/Python/Java we can usually replace the bits necessary to make it not vulnerable and get an exception granted, but for Go/Rust and or other binaries we are stuck getting exception approval and building additional security around the product to make sure that exploit can't be attacked. > 2. Is anyone aware of a security database & evaluation tool geared for vendors not for end-users? As in: Gets a feed of CVEs relevant for our products, each of them needs to be analyzed, amended, new CVSS vector and our own analyze result and then publish them to a feed, potentially emailing all affected customers Even if you made this available, we HAVE to use the NVD/CVE scores themselves. We can't deviate just because the vendor says so, unfortunately. I would love for vendors to have something like this integrated though as some vendors have hopelessly outdated versions of libraries in their products because it is a lot of work for their teams to upgrade/test/validate that the new version doesn't break anything versus just sticking with the known quantity. Upgrading dependencies in a project is work, and the larger the project, the more dependencies, unless you have a really good testing framework it becomes a HUGE chore, and there is always some new feature that gets priority over gardening tasks.

lars_francke 3y ago
Thanks for the detailed response. Rebuilding the Docker images sounds painful! It is a minefield. Before starting our product company we did a lot of consulting gigs and security updates etc. were a big part of this. We have seen the other side of this for 10+ years and _want_ to do a good job but it's not actually easy to define what _good job_ means here. If you have any feedback for us what would make your life as a customer easier please do let me know (my E-Mail address is also in my profile)

wallrat 3y ago

DISCLOSURE: I'm working on commercial tooling for this exact problem [1] > 1) What would your expectations be towards a software vendor in terms of what issues to "fix"? I would want the vendor to communicate their analysis for all CVEs, i.e. letting us know which are exploitable or not, and what kind of response they are planning, or any fixes released. There are efforts to standardize this workflow with Vulnerability Disclosure Reports (VDRs)[2] and Vulnerability Exploitability eXchange VEXs[3]. Both these use cases are covered by OWASP CycloneDx[4]. > 2) Is anyone aware of a security database & evaluation tool geared for vendors not for end-users? IMHO, there are not any good tools available that solve the complete workflow. We are certainly aiming to fix that with[1], but it will take some time. [1] https://sbom.observer https://sbom.observer [2] https://www.cisa.gov/resources-tools/resources/minimum-requirements-vulnerability-exploitability-exchange-vex https://www.cisa.gov/resources-tools/resources/minimum-requi... [3] https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/f... [4] https://cyclonedx.org/capabilities/vex/ https://cyclonedx.org/capabilities/vex/

lars_francke 3y ago
Thank you. I haven't had time to dig into your tool yet but I did click the "Join Beta" link, unfortunately that doesn't do anything right now. Feel free to reach out to me via my e-mail from my profile if you're interested in Beta testers.