|
Dave Huseby <dhuseby@...>
Hello TSC,
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages. Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy. Cheers! Dave --- David Huseby Security Maven, Hyperledger The Linux Foundation +1-206-234-2392 dhuseby@...
|
|
|
Mic Bowman
seems low risk to release. +1
--mic
On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby < dhuseby@...> wrote: Hello TSC,
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages. Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy. Cheers! Dave --- David Huseby Security Maven, Hyperledger The Linux Foundation +1-206-234-2392 dhuseby@...
|
|
|
hmontgomery@us.fujitsu.com <hmontgomery@...>
+1. As usual, I’m pretty much always in favor of releasing these.
Can we automate this process? It seems like we should have some kind of policy in the vein of “release the security audits unless there are major outstanding
issues.”
Thanks,
Hart
toggle quoted message
Show quoted text
From: tsc@... [mailto:tsc@...]
On Behalf Of Mic Bowman
Sent: Tuesday, February 19, 2019 3:29 PM
To: Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security audit report
seems low risk to release.
On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby <dhuseby@...> wrote:
Hello TSC,
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.
Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange
for you to receive a copy.
Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...
|
|
|
Olson, Kelly M <kelly.m.olson@...>
toggle quoted message
Show quoted text
From: tsc@... [mailto:tsc@...]
On Behalf Of hmontgomery@...
Sent: Tuesday, February 19, 2019 4:00 PM
To: Mic Bowman <cmickeyb@...>; Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security audit report
+1. As usual, I’m pretty much always in favor of releasing these.
Can we automate this process? It seems like we should have some kind of policy in the vein of “release the security audits unless there are major outstanding
issues.”
Thanks,
Hart
From:
tsc@... [mailto:tsc@...]
On Behalf Of Mic Bowman
Sent: Tuesday, February 19, 2019 3:29 PM
To: Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security audit report
seems low risk to release.
On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby <dhuseby@...> wrote:
Hello TSC,
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.
Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange
for you to receive a copy.
Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...
|
|
|
Dave Huseby <dhuseby@...>
That's a good proposal Hart. The policy now is to ask for approval to release these but it probably should be revised to: "release them as soon as all high and medium issues are resolved and only ask for TSC approval if there are any outstanding issues.".
If y'all agree, I'll make a formal policy change request to this list and we can do a quick vote on Thursday. That will streamline things.
Dave
+1. As usual, I’m pretty much always in favor of releasing these.
Can we automate this process? It seems like we should have some kind of policy in the vein of “release the security audits unless there are major outstanding
issues.”
Thanks,
Hart
From: tsc@... [mailto:tsc@...]
On Behalf Of Mic Bowman
Sent: Tuesday, February 19, 2019 3:29 PM
To: Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security audit report
seems low risk to release.
On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby <dhuseby@...> wrote:
Hello TSC,
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.
Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange
for you to receive a copy.
Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...
|
|
|
+1 to both releasing the report and proposing a change to the process.
mark
On Tue, Feb 19, 2019, 19:09 Dave Huseby < dhuseby@...> wrote: That's a good proposal Hart. The policy now is to ask for approval to release these but it probably should be revised to: "release them as soon as all high and medium issues are resolved and only ask for TSC approval if there are any outstanding issues.".
If y'all agree, I'll make a formal policy change request to this list and we can do a quick vote on Thursday. That will streamline things.
Dave
+1. As usual, I’m pretty much always in favor of releasing these.
Can we automate this process? It seems like we should have some kind of policy in the vein of “release the security audits unless there are major outstanding
issues.”
Thanks,
Hart
From: tsc@... [mailto:tsc@...]
On Behalf Of Mic Bowman
Sent: Tuesday, February 19, 2019 3:29 PM
To: Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security audit report
seems low risk to release.
On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby <dhuseby@...> wrote:
Hello TSC,
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.
Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange
for you to receive a copy.
Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...
|
|
|
Baohua Yang
+1! Thanks dave for the work!
On Wed, Feb 20, 2019 at 6:19 AM Dave Huseby < dhuseby@...> wrote: Hello TSC,
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages. Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy. Cheers! Dave --- David Huseby Security Maven, Hyperledger The Linux Foundation +1-206-234-2392 dhuseby@...
|
|
|
Likewise! +1.
Thanks.
--
Arnaud Le Hors - Senior Technical Staff Member, Web & Blockchain
Open Technologies - IBM
From:
"Mark Wagner"
<mwagner114@...>
To:
David Huseby <dhuseby@...>
Cc:
Hart Montgomery <hmontgomery@...>,
Mic Bowman <cmickeyb@...>, Hyperledger List <tsc@...>
Date:
02/20/2019 01:34 AM
Subject:
Re: [Hyperledger
TSC] Proposed release of the Composer security audit report
Sent by:
tsc@...
+1 to both releasing the report and proposing a change
to the process.
mark
toggle quoted message
Show quoted text
On Tue, Feb 19, 2019, 19:09 Dave Huseby < dhuseby@...>
wrote: That's a good proposal Hart. The policy now is to ask
for approval to release these but it probably should be revised to: "release
them as soon as all high and medium issues are resolved and only ask for
TSC approval if there are any outstanding issues.". If y'all agree, I'll make a formal policy change request
to this list and we can do a quick vote on Thursday. That will streamline
things. Dave --- David Huseby Security Maven, Hyperledger The Linux Foundation
+1-206-234-2392
dhuseby@...On Tue, Feb 19, 2019 at 4:00 PM Montgomery, Hart < hmontgomery@...>
wrote: +1. As usual, I’m
pretty much always in favor of releasing these. Can we automate this process?
It seems like we should have some kind of policy in the vein of “release
the security audits unless there are major outstanding issues.” Thanks, Hart From: tsc@...[mailto:tsc@...]
On Behalf Of Mic Bowman
Sent: Tuesday, February 19, 2019 3:29 PM
To: Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security
audit report seems low risk to release. +1 --mic On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby <dhuseby@...>
wrote: Hello TSC,
The time has come for the TSC to approve the release of the Composer audit
report. The Composer audit done by Nettitude found a total of five
issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for
logging into blockchain instances were stored in world-readable files instead
of only user-readable files.
The second of the medium risk errors was the playground server accepting
connections from any source IP address. This was solved by changing the
code to bind to the loopback interface.
The other issues were about accepting non-TLS connections
and leaking unnecessary information in log error messages.
Now that all of the issues of medium or higher have been fixed, it is time
to publish the report and announce it. As always, if you are a member of
the TSC and would like to read the reports before approving them, please
email me directly and I will arrange for you to receive a copy.
Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@... ---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...
|
|
|
toggle quoted message
Show quoted text
On Tue, Feb 19, 2019 at 5:19 PM Dave Huseby < dhuseby@...> wrote: Hello TSC,
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages. Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy. Cheers! Dave --- David Huseby Security Maven, Hyperledger The Linux Foundation +1-206-234-2392 dhuseby@...
|
|
|
Nathan George <nathan.george@...>
toggle quoted message
Show quoted text
On Tue, Feb 19, 2019 at 5:19 PM Dave Huseby < dhuseby@...> wrote: Hello TSC,
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages. Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy. Cheers! Dave --- David Huseby Security Maven, Hyperledger The Linux Foundation +1-206-234-2392 dhuseby@...
|
|
|
