Skip to content

Commit

Permalink
[docs] updates to CVE table status column (yugabyte#23225)
Browse files Browse the repository at this point in the history 
* updates to status column

* review comment

* format

---------

Co-authored-by: Dwight Hodge <ghodge@yugabyte.com>
  • Loading branch information
@aishwarya24 @ddhodge @vaibhav-yb
2 people authored and vaibhav-yb committed Jul 23, 2024
1 parent ff799a8 commit f1329ce
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions docs/content/preview/secure/vulnerability-disclosure-policy.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ type: docs

An important part of Yugabyte's strategy for building a secure platform for our users is vulnerability reporting. We value working with the broader security research community and understand that fostering that relationship will help Yugabyte improve its own security posture. We take vulnerabilities very seriously regardless of source, and strongly encourage people to report security vulnerabilities **privately to our security team** before disclosing them in a public forum. Our goal is to surface vulnerabilities and resolve them privately before they can be exploited.

## Our Commitment
## Our commitment

1. **In scope** We commit to investigate and address any reported issues, and request that you use the following process for the reporting of security vulnerabilities in the following products:

Expand All @@ -30,7 +30,7 @@ An important part of Yugabyte's strategy for building a secure platform for our

1. We assure you that we will not initiate legal action against researchers who are acting in good faith and adhering to this process.

## The Process
## The process

1. **Report the Concern.** If you have any security concerns or would like to report undisclosed security vulnerabilities in our products or services, please email us at [security@yugabyte.com](mailto:security@yugabyte.com). Note that we do not accept bug reports at this address.

Expand All @@ -49,7 +49,7 @@ An important part of Yugabyte's strategy for building a secure platform for our

1. **Use Common Sense.** Please use common sense when looking for security issues with our products. Attacking or compromising Yugabyte users' installations, or attacks on our infrastructure are not permitted.

## Next Steps
## Next steps

1. We will promptly investigate any reported issue. In certain cases, we may work privately with you to resolve the vulnerability. We may choose not to disclose information publicly while we investigate and mitigate any risk.

Expand Down Expand Up @@ -81,18 +81,18 @@ Note that this policy covers only vulnerabilities in the query layer of PostgreS

| Product | Name | Fixed in YugabyteDB version | Status |
| :------ | :--- | :--------------------- | :----- |
| PostgreSQL&nbsp;(YSQL) | {{<cve "CVE-2019-10127">}} | | Not applicable |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10128">}} | | Not applicable |
| PostgreSQL&nbsp;(YSQL) | {{<cve "CVE-2019-10127">}} | | Not applicable: YugabyteDB only runs on Linux, this vulnerability is Windows-specific. |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10128">}} | | Not applicable: YugabyteDB only runs on Linux, this vulnerability is Windows-specific. |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10129">}} | [v2.7.1](/preview/releases/ybdb-releases/end-of-life/v2.7/#v2-7-1-1-may-25-2021)| Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10130">}} | [v2.12.11.0](/preview/releases/ybdb-releases/end-of-life/v2.12/#v2.12.11.0), {{<release "2.14.3.0">}}, {{<release "2.15.4.0">}} | Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10164">}} | [v2.12.11.0](/preview/releases/ybdb-releases/end-of-life/v2.12/#v2.12.11.0), {{<release "2.14.3.0">}}, {{<release "2.15.3.0">}} | Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10208">}} | [v2.12.11.0](/preview/releases/ybdb-releases/end-of-life/v2.12/#v2.12.11.0), {{<release "2.14.3.0">}}, {{<release "2.15.4.0">}} | Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10209">}} | [v2.12.11.0](/preview/releases/ybdb-releases/end-of-life/v2.12/#v2.12.11.0), {{<release "2.14.3.0">}}, {{<release "2.15.4.0">}} | Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10210">}} | | Not applicable |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10211">}} | | Not applicable |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-3466">}} | | Not applicable |
| PostgreSQL (YSQL) | {{<cve "CVE-2020-10733">}} | | Not applicable |
| PostgreSQL (YSQL) | {{<cve "CVE-2020-14349">}} | | Not applicable |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10210">}} | | Not applicable: YugabyteDB only runs on Linux, this vulnerability is Windows-specific. |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-10211">}} | | Not applicable: YugabyteDB only runs on Linux, this vulnerability is Windows-specific. |
| PostgreSQL (YSQL) | {{<cve "CVE-2019-3466">}} | | Not applicable: pg_ctlcluster is not included in installation. |
| PostgreSQL (YSQL) | {{<cve "CVE-2020-10733">}} | | Not applicable: YugabyteDB only runs on Linux, this vulnerability is Windows-specific. |
| PostgreSQL (YSQL) | {{<cve "CVE-2020-14349">}} | | Not applicable: YugabyteDB does not use logical replication. |
| PostgreSQL (YSQL) | {{<cve "CVE-2020-14350">}} | [v2.12.11.0](/preview/releases/ybdb-releases/end-of-life/v2.12/#v2.12.11.0), {{<release "2.14.5.0">}}, {{<release "2.16.0.0">}}, {{<release "2.17.1.0">}}| Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2020-1720">}} | | Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2020-25694">}} | [v2.7.1](/preview/releases/ybdb-releases/end-of-life/v2.7/#v2-7-1-1-may-25-2021) or later | Resolved |
Expand All @@ -111,5 +111,5 @@ Note that this policy covers only vulnerabilities in the query layer of PostgreS
| PostgreSQL (YSQL) | {{<cve "CVE-2022-2625">}} | [v2.12.10.0](/preview/releases/ybdb-releases/end-of-life/v2.12/#v2.12.10.0), {{<release "2.14.2.0">}}, {{<release "2.15.3.0">}}| Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2023-2454">}} | {{<release "2.18.1.0">}}| Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2023-2455">}} | {{<release "2.14.10.2">}}, {{<release "2.16.5.0">}}, {{<release "2.18.0.0">}}, {{<release "2.20.0.0">}}| Resolved |
| PostgreSQL (YSQL) | {{<cve "CVE-2023-32305">}} | | Not applicable |
| PostgreSQL (YSQL) | {{<cve "CVE-2023-32305">}} | | Not applicable: [aiven-extras](https://github.com/aiven/aiven-extras) is not included in installation. |
| PostgreSQL (YSQL) | {{<cve "CVE-2023-39417">}} | {{<release "2.20.1.0">}}, {{<release "2.14.15.0">}}, {{<release "2.16.9.0">}}, {{<release "2.18.5.0">}}| Resolved |

0 comments on commit f1329ce

Please sign in to comment.