Re: Proposed release of the Composer security audit report


Mark Wagner
 

+1 to both releasing the report and proposing a change to the process.

mark

On Tue, Feb 19, 2019, 19:09 Dave Huseby <dhuseby@...> wrote:
That's a good proposal Hart. The policy now is to ask for approval to release these but it probably should be revised to: "release them as soon as all high and medium issues are resolved and only ask for TSC approval if there are any outstanding issues.".

If y'all agree, I'll make a formal policy change request to this list and we can do a quick vote on Thursday. That will streamline things.

Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...


On Tue, Feb 19, 2019 at 4:00 PM Montgomery, Hart <hmontgomery@...> wrote:

+1.  As usual, I’m pretty much always in favor of releasing these.

 

Can we automate this process?  It seems like we should have some kind of policy in the vein of “release the security audits unless there are major outstanding issues.”

 

Thanks,

Hart

 

From: tsc@... [mailto:tsc@...] On Behalf Of Mic Bowman
Sent: Tuesday, February 19, 2019 3:29 PM
To: Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security audit report

 

seems low risk to release. 

+1

 

--mic

 

 

On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby <dhuseby@...> wrote:

Hello TSC,

The time has come for the TSC to approve the release of the Composer audit report.  The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.

The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.


The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.

 

The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.

Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy.

Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

Join tsc@lists.hyperledger.org to automatically receive all group messages.