Skip to content

chore: Add CVE template #2752

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+32 −0
Open

chore: Add CVE template #2752

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions .github/ISSUE_TEMPLATE/cve_report.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
---
name: CVE report
about: Report a CVE detected in kube-state-metrics main branch
title: ''
labels: kind/cve
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Introduced a new label to keep CVEs away from kind/bugs categorisation.

assignees: ''

---

<!-- Please use this template while reporting a CVE and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!

If the matter is proven to be security related, please disclose it privately see https://github.com/kubernetes/kube-state-metrics/blob/main/SECURITY.md

NOTE: Only the CVEs that are in the Golang vulnerability database and actively affect code paths in KSM will be considered.
-->

<!-- `govulncheck` data should include the command ran and should clearly mention the CVE in question in the logs -->

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add a checklist here

Suggested change
[ ] I am aware that output from other scanners is high likely a false positive and the issue will be marked as spam.
[ ] I have verified that govulncheck reports the vulnerability in the latest main

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rexagod do we want to include this?

### `govulncheck` output

```console

```

### Anything else we need to know?

### Environment

* kube-state-metrics version:
* Kubernetes version (use `kubectl version`):
* Cloud provider or hardware configuration:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this needed for CVEs?

* Other info: