Please send security vulnerability reports to the Help Desk.
Submitting an Issue¶
When we receive a security issue we evaluate it and, if we identify it as a vulnerability, we will work to fix it or to propose a remediation according to the issue severity.
The following cots library are integrated in Punchplatform deployment and are used in integration with Punchplatform proprietary code :
The applicable cots version are listed in the Release notes for your version
|Product name||DAVE 6.0.0|
Punchplatform security advisories include a severity level. This severity level is based on our self-appreciation for each specific vulnerability for the Punchplatform product.
Severity Level: Critical¶
Vulnerabilities that score in the critical range usually have most of the following characteristics:
Exploitation of the vulnerability likely results in root-level compromise of servers or infrastructure devices.
Exploitation is usually straightforward, in the sense that the attacker does not need any special authentication credentials.
For critical vulnerabilities, is advised that you patch or upgrade as soon as possible, unless you have other mitigating measures in place.
For example, a mitigating factor could be if your installation is not accessible from the Internet.
Severity Level: High¶
Vulnerabilities that score in the high range usually have some of the following characteristics:
- The vulnerability is difficult to exploit.
- Exploitation could result in elevated privileges.
- Exploitation could result in a significant data loss or downtime.
Severity Level: Medium¶
Vulnerabilities that score in the medium range usually have some of the following characteristics:
- Vulnerabilities where exploitation provides only very limited access.
- Vulnerabilities that require user privileges for successful exploitation.
Severity Level: Low¶
Vulnerabilities in the low range typically have very little impact on an platform's business. Exploitation of such vulnerabilities usually requires local or physical system access.
|Security Advisory||Date||Level||Component||Affects||Vulnerability summary||Mitigation|
How to upgrade¶
In the case of updating a component of the platform, the guides below let you apply the corrections in function of the type of component to be updated.
How to patch a COTS component like Storm, Spark, Kafka or Zookeeper.
How to patch a Punch Jar component like punchplatform-operator, punchplatform-shiva...
Upgrade an Elastic component
Because Elasticsearch, Kibana, Logstash and the Elastic Beats are dependent on each other for the same versions. Applying a patch on one of the components may cause the other components to update.
- How to patch an Elastic component like Elasticsearch, Kibana, Metricbeat, Filebeat, Auditbeat, Logstash.
- How to patch Kibana for security reason
- How to switch of Elasticsearch version with the deployer