- Proposed release of the Composer security audit report
Re: Proposed release of the Composer security audit report
toggle quoted messageShow quoted text
+1 to both releasing the report and proposing a change to the process.
On Tue, Feb 19, 2019, 19:09 Dave Huseby <dhuseby@...
That's a good proposal Hart. The policy now is to ask for approval to release these but it probably should be revised to: "release them as soon as all high and medium issues are resolved and only ask for TSC approval if there are any outstanding issues.".
If y'all agree, I'll make a formal policy change request to this list and we can do a quick vote on Thursday. That will streamline things.
+1. As usual, I’m pretty much always in favor of releasing these.
Can we automate this process? It seems like we should have some kind of policy in the vein of “release the security audits unless there are major outstanding
From: tsc@... [mailto:tsc@...]
On Behalf Of Mic Bowman
Sent: Tuesday, February 19, 2019 3:29 PM
To: Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security audit report
seems low risk to release.
On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby <dhuseby@...> wrote:
The time has come for the TSC to approve the release of the Composer audit report. The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.
The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.
The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.
The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.
Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange
for you to receive a copy.
Security Maven, Hyperledger
The Linux Foundation
Join email@example.com to automatically receive all group messages.