| <!DOCTYPE html> |
| <html> |
| <head> |
| <title>Apache CloudStack: Open Source Cloud Computing</title> |
| |
| <meta name="description" content="CloudStack is open source cloud computing software for creating, managing, and deploying infrastructure cloud services"> |
| |
| <meta itemprop="name" content="Apache Cloudstack"> |
| <meta itemprop="description" content="CloudStack is open source cloud computing software for creating, managing, and deploying infrastructure cloud services"> |
| <meta itemprop="image" content="https://cloudstack.apache.org/images/monkey-144.png"> |
| |
| <meta property="og:title" content="Apache Cloudstack"> |
| <meta property="og:description" content="CloudStack is open source cloud computing software for creating, managing, and deploying infrastructure cloud services"> |
| <meta property="og:site_name" content="Apache Cloudstack"/> |
| <meta property="og:image" content="https://cloudstack.apache.org/images/monkey-144.png"> |
| |
| <meta name="twitter:card" content="summary"> |
| <meta name="twitter:title" content="Apache Cloudstack"> |
| <meta name="twitter:description" content="CloudStack is open source cloud computing software for creating, managing, and deploying infrastructure cloud services"> |
| <meta name="twitter:image:src" content="https://cloudstack.apache.org/images/monkey-144.png"> |
| |
| <meta http-equiv="Content-Type" content="text/html;charset=UTF-8"> |
| <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=1"> |
| |
| <link href="stylesheets/bootstrap.css" rel="stylesheet" media="screen"> |
| <link href="stylesheets/font-awesome.css" rel="stylesheet"> |
| <link href="stylesheets/bootswatch.min.css" rel="stylesheet"> |
| <link href="stylesheets/custom.css" rel="stylesheet"> |
| |
| <link rel="shortcut icon" href="images/favicon.ico"> |
| <link rel="icon" href="images/favicon.ico"> |
| |
| <!-- {% if headers.notice %}{{ headers.notice }}{% endif %} --> |
| <!-- Twitter Bootstrap and jQuery after this line. --> |
| <script src="https://code.jquery.com/jquery-latest.js"></script> |
| <script src="https://netdna.bootstrapcdn.com/bootstrap/3.0.0/js/bootstrap.min.js"></script> |
| <script> |
| $('.dropdown-toggle').dropdown(); |
| $('.nav-collapse').collapse(); |
| </script> |
| </head> |
| <body> |
| <div class="navbar navbar-default navbar-fixed-top"> |
| <div class="container"> |
| <div class="navbar-header"> |
| <a href="index.html" class="navbar-brand"><img class="" src="images/new-logo-sm.png" style="width: 200px" alt="Apache Cloudstack"></a> |
| <button class="navbar-toggle collapsed" type="button" data-toggle="collapse" data-target="#navbar-main"> |
| <span class="icon-bar"></span> |
| <span class="icon-bar"></span> |
| <span class="icon-bar"></span> |
| </button> |
| </div> |
| <div class="navbar-collapse collapse" id="navbar-main"> |
| <ul class="nav navbar-nav"> |
| <li class="dropdown"> |
| <a class="dropdown-toggle" data-toggle="dropdown" href="#" id="about">About <span class="caret"></span></a> |
| <ul class="dropdown-menu" aria-labelledby="about"> |
| <li><a tabindex="-1" href="about.html">About</a></li> |
| <li class="divider"></li> |
| <li><a tabindex="-1" href="https://blogs.apache.org/cloudstack/" target="_blank">Blog<span class="glyphicon glyphicon-share-alt pull-right"></span></a></li> |
| <li><a tabindex="-1" href="history.html">History</a></li> |
| <li><a tabindex="-1" href="features.html">Features</a></li> |
| <li><a tabindex="-1" href="bylaws.html">Community Bylaws</a></li> |
| <li><a tabindex="-1" href="who.html">Who We Are</a></li> |
| <li><a tabindex="-1" href="security.html">Security</a></li> |
| </ul> |
| </li> |
| <li class="dropdown"> |
| <a class="dropdown-toggle" data-toggle="dropdown" href="#" id="community">Community <span class="caret"></span></a> |
| <ul class="dropdown-menu" aria-labelledby="community"> |
| <li><a tabindex="-1" href="contribute.html">Get Involved</a></li> |
| <li><a tabindex="-1" href="developers.html">Developers</a></li> |
| <li><a tabindex="-1" href="mailing-lists.html">Mailing Lists</a></li> |
| <li><a tabindex="-1" href="http://cloudstackcollab.org/" target="_blank">Events & Meetups <span class="glyphicon glyphicon-share-alt pull-right"></span></a></li> |
| </ul> |
| </li> |
| <li class="dropdown"> |
| <a class="dropdown-toggle" data-toggle="dropdown" href="#" id="users">Users <span class="caret"></span></a> |
| <ul class="dropdown-menu" aria-labelledby="users"> |
| <li><a tabindex="-1" href="users.html">Known Users</a></li> |
| <li><a tabindex="-1" href="https://cwiki.apache.org/confluence/display/CLOUDSTACK/Case+Studies" target="_blank">Case Studies <span class="glyphicon glyphicon-share-alt pull-right"></span></a></li> |
| <li><a tabindex="-1" href="survey.html">Take Survey</a></li> |
| </ul> |
| </li> |
| <li class="dropdown"> |
| <a class="dropdown-toggle" data-toggle="dropdown" href="#" id="docs">Documentation <span class="caret"></span></a> |
| <ul class="dropdown-menu" aria-labelledby="docs"> |
| <li><a tabindex="-1" href="http://docs.cloudstack.apache.org" target="_blank">CloudStack Documentation</span></a></li> |
| <li><a tabindex="-1" href="https://cwiki.apache.org/confluence/display/CLOUDSTACK/Home" target="_blank">Wiki</a></li> |
| <li><a tabindex="-1" href="https://cwiki.apache.org/confluence/display/CLOUDSTACK/CloudStack+Books" target="_blank">Books</a></li> |
| <li><a tabindex="-1" href="api.html">API Documentation</a></li> |
| <li class="divider"></li> |
| <li><a tabindex="-1">Archived Documentation</a></li> |
| <li><a tabindex="-1" href="http://docs.cloudstack.apache.org/projects/archived-cloudstack-getting-started" target="_blank"> Getting Started Docs</span></a></li> |
| <li><a tabindex="-1" href="http://docs.cloudstack.apache.org/projects/archived-cloudstack-installation" target="_blank"> Installation Docs</a></li> |
| <li><a tabindex="-1" href="http://docs.cloudstack.apache.org/projects/archived-cloudstack-administration" target="_blank"> Administration Docs</a></li> |
| <li><a tabindex="-1" href="http://docs.cloudstack.apache.org/projects/archived-cloudstack-release-notes" target="_blank"> Release Notes</a></li> |
| </ul> |
| </li> |
| <li class="dropdown"> |
| <a class="dropdown-toggle" data-toggle="dropdown" href="#" id="download">Download <span class="caret"></span></a> |
| <ul class="dropdown-menu" aria-labelledby="download"> |
| <li><a tabindex="-1" href="downloads.html">CloudStack Releases</a></li> |
| <li><a tabindex="-1" href="downloads.html#cloudmonkey">CloudMonkey</a></li> |
| <li><a tabindex="-1" href="archives.html">Release Archive</a></li> |
| </ul> |
| </li> |
| <li class="dropdown"> |
| <a class="dropdown-toggle" data-toggle="dropdown" href="#" id="apache">Apache <span class="caret"></span></a> |
| <ul class="dropdown-menu" aria-labelledby="apache"> |
| <li><a tabindex="-1" href="http://apache.org">Apache Software Foundation</a></li> |
| <li><a tabindex="-1" href="http://www.apache.org/licenses/">License</a></li> |
| <li><a tabindex="-1" href="http://www.apache.org/foundation/sponsorship.html">Sponsorship</a></li> |
| <li><a tabindex="-1" href="http://www.apache.org/foundation/thanks.html">Thanks</a></li> |
| </ul> |
| </li> |
| </ul> |
| </div> |
| </div> |
| </div> |
| <div class="container"> |
| <div class="bs-docs-section"> |
| <div class="row"> |
| |
| <div class="col-lg-12"> |
| |
| <div class="page-header"> |
| |
| <h1 id="indicators">Apache CloudStack: Security</h1> |
| |
| </div> |
| |
| </div> |
| |
| </div> |
| |
| <p>The Apache CloudStack project understands that as a core infrastructure project, the application security of Apache CloudStack is of critical importance to the community and users.</p> |
| |
| <h2 id="apache-cloudstack-security-team">Apache CloudStack Security Team</h2> |
| |
| <p>The PMC has decided to create a "Security Team" for CloudStack. The Security Team's charter is to manage the response to vulnerabilities reported with Apache CloudStack. This includes communication with the report, issue verification, issue correction, public communication creation, and vendor coordination. The Security Team may ask assistance from other community members to help verify or correct a reported issue.</p> |
| |
| <p>Members of the PMC are eligible to join the security team, but lurking is discouraged.</p> |
| |
| <p>Community members engaged by the Security Team are expected to hold the issue in confidence until public announcement of the vulnerability. This protects the users of the software and gives reasonable time for the response process to be implemented. Further information can be found on the ASF's <a href="http://www.apache.org/foundation/how-it-works.html">How it Works</a> page.</p> |
| |
| <p>The CloudStack security team works closely with, and under the direction of, the <a href="http://www.apache.org/security/">ASF security team</a>.</p> |
| |
| <h2 id="reporting-potential-vulnerabilities-in-apache-cloudstack">Reporting Potential Vulnerabilities in Apache CloudStack</h2> |
| |
| <p>If you've found an issue that you believe is a security vulnerability in a released version of CloudStack, please report it to <a href="mailto:security@cloudstack.apache.org">security@cloudstack.apache.org</a> with details about the vulnerability, how it might be exploited, and any additional information that might be useful.</p> |
| |
| <p>Upon notification, the ACS security team will initiate the security response procedure. If the issue is validated, the team generally takes 2-4 weeks from notification to public announcement of the vulnerability. During this time, the team will communicate with you as they proceed through the response procedure, and ask that the issue not be announced before an agreed-upon date.</p> |
| |
| <p>The security team asks that you <strong>please do not create publicly-viewable JIRA tickets related to the issue</strong>. If validated, a JIRA ticket with the security flag set will be created for tracking the issue in a non-public manner.</p> |
| |
| <h2 id="procedure-for-responding-to-potential-security-issues">Procedure for Responding to Potential Security Issues</h2> |
| |
| <ul> |
| <li>Upon receiving notice of a potential security issue, a security team member will create a bug to track the investigation, this bug must be flagged as a security issue. Security flag should mean contents of ticket are not visible to non-security team members</li> |
| <li>Security team investigates the issue to confirm/deny the presence of a vulnerability within CloudStack</li> |
| <li>If the issue is determined not to be a vulnerability the reporter will be notified and the issue will be closed as invalid</li> |
| <li>If issue is confirmed as a CloudStack vulnerability: |
| <ul> |
| <li>Security team notifies the Apache Security team</li> |
| <li>Security team assigns a risk rating to the vulnerability using the Common Vulnerability Scoring System</li> |
| <li>Security team works with reporter to get a chance to investigate and mitigate the issue in a timely manner before public announcement. This should be between 15-30 days, depending on the severity and complexity of the issue</li> |
| <li>Security team works with Apache Security Team to reserve a CVE Identifier for future public release</li> |
| <li>Security team works with appropriate code maintainer(s) to create patch to mitigate the issue</li> |
| <li>Testing is conducted to verify patch mitigates issue and does not cause regression errors</li> |
| <li>Security team creates a vulnerability announcement</li> |
| <li>Patch is committed to trunk and other supported branches that are affected. The commit should not refer to a particular vulnerability</li> |
| <li>A new CloudStack release or hotfix is prepared and tested, containing the new security patch</li> |
| <li>Distributor coordination is implemented to enable a coordinated announcement</li> |
| <li>Security team posts vulnerability announcement to... |
| <ul> |
| <li>CloudStack dev list</li> |
| <li>CloudStack users list</li> |
| <li>The Bugtraq mailing list</li> |
| </ul> |
| </li> |
| <li>After announcement, CHANGES and NEWS files need to be updated to reflect the vulnerability and fix. This must happen AFTER the announcement.</li> |
| <li>Also after announcement, modify the Jira ticket so that the issue is now publicly viewable.</li> |
| </ul> |
| </li> |
| <li>After the vulnerability is addressed, the CloudStack community should review development processes to see how the community can minimize the chance of similar vulnerabilities being introduced in the future.</li> |
| </ul> |
| |
| <h2 id="for-further-information">For further information</h2> |
| |
| <p>Further information about Apache CloudStack's security practices can be found in the <a href="https://cwiki.apache.org/confluence/display/CLOUDSTACK/CloudStack+Security">CloudStack Security wiki page</a>.</p> |
| |
| |
| |
| <footer> |
| <p>Copyright © 2020 The Apache Software Foundation, Licensed under the Apache License, Version 2.0. <br/> |
| "Apache", "CloudStack", "Apache CloudStack", the Apache CloudStack logo, the Apache CloudStack Cloud Monkey logo and the Apache feather logos are registered trademarks or trademarks of The Apache Software Foundation.</p> |
| <p><a href="/trademark-guidelines.html">Apache CloudStack Trademark Usage</a> - <a href="/bylaws.html">Apache CloudStack Community ByLaws</a></p> |
| </footer> |
| |
| </div> |
| </div> |
| </div> |
| </body> |
| </html> |
