Skip to content

Commit cafe6d2

Browse files
PushkarJnehaLohia27Tim Bannister
committed
Fetch and Render CVE JSON feed
- Pull JSON blob from queried issues - Use layout output formats + templates to generate HTML table and JSON blob - Add localized strings and caption for CVE feed - Add a new page to describe details about CVE feed and how to use it - Update existing pages and link the official CVE feed from it Co-authored-by: Neha Lohia <[email protected]> Co-authored-by: Tim Bannister <[email protected]>
1 parent acdef19 commit cafe6d2

File tree

6 files changed

+122
-2
lines changed

6 files changed

+122
-2
lines changed

‎config.toml

+3
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,9 @@ algolia_docsearch = false
169169
# Enable Lunr.js offline search
170170
offlineSearch = false
171171

172+
# Official CVE feed bucket URL
173+
cveFeedBucket = "https://storage.googleapis.com/k8s-cve-feed/official-cve-feed.json"
174+
172175
[params.pushAssets]
173176
css = [
174177
"callouts",

‎content/en/docs/reference/issues-security/issues.md

+5-2
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ To report a security issue, please follow the [Kubernetes security disclosure pr
88

99
Work on Kubernetes code and public issues are tracked using [ Issues](https://.com/kubernetes/kubernetes/issues/).
1010

11-
* [CVE-related issues](https://.com/kubernetes/kubernetes/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Aarea%2Fsecurity+in%3Atitle+CVE)
11+
* Official [list of known CVEs](/docs/reference/issues-security/official-cve-feed/)
12+
(security vulnerabilities) that have been announced by the
13+
[Security Response Committee](https://.com/kubernetes/committee-security-response)
14+
* [CVE-related issues](https://.com/kubernetes/kubernetes/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Aarea%2Fsecurity+in%3Atitle+CVE)
1215

13-
Security-related announcements are sent to the [[email protected]](https://groups.google.com/forum/#!forum/kubernetes-security-announce) mailing list.
16+
Security-related announcements are sent to the [[email protected]](https://groups.google.com/forum/#!forum/kubernetes-security-announce) mailing list.

‎content/en/docs/reference/issues-security/official-cve-feed.md

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
title: Official CVE Feed
3+
weight: 25
4+
outputs:
5+
- json
6+
- html
7+
layout: cve-feed
8+
---
9+
10+
{{< feature-state for_k8s_version="v1.25" state="alpha" >}}
11+
12+
This is a community maintained list of official CVEs announced by
13+
the Kubernetes Security Response Committee. See
14+
[Kubernetes Security and Disclosure Information](/docs/reference/issues-security/security/)
15+
for more details.
16+
17+
The Kubernetes project publishes a programmatically accessible
18+
[JSON Feed](/docs/reference/issues-security/official-cve-feed/index.json) of
19+
published security issues. You can access it by executing the following command:
20+
21+
{{< comment >}}
22+
`replace` is used to bypass known issue with rendering ">"
23+
: https://.com/gohugoio/hugo/issues/7229 in JSON layouts template
24+
`layouts/_default/cve-feed.json`
25+
{{< /comment >}}
26+
27+
```shell
28+
curl -v https://k8s.io/docs/reference/issues-security/official-cve-feed/index.json
29+
```
30+
31+
{{< cve-feed >}}
32+
33+
<!-- | CVE ID | Issue Summary | CVE Issue URL |
34+
| ----------- | ----------- | --------- |
35+
| [CVE-2021-25741](https://www.cve.org/CVERecord?id=CVE-2021-25741) | Symlink Exchange Can Allow Host Filesystem Access | [#104980](https://.com/kubernetes/kubernetes/issues/104980) |
36+
| [CVE-2020-8565](https://www.cve.org/CVERecord?id=CVE-2020-8565) | Incomplete fix for CVE-2019-11250 allows for token in logs when logLevel >= 9 | [#95623](https://.com/kubernetes/kubernetes/issues/95623) | -->
37+
38+
This feed is auto-refreshing with a noticeable but small lag (minutes to hours)
39+
from the time a CVE is announced to the time it is accessible in this feed.
40+
41+
The source of truth of this feed is a set of Issues, filtered by a controlled and
42+
restricted label `official-cve-feed`. The raw data is stored in a Google Cloud
43+
Bucket which is writable only by a small number of trusted members of the
44+
Community.

‎data/i18n/en/en.toml

+28
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,34 @@ other = "Twitter"
2727
[community_youtube_name]
2828
other = "YouTube"
2929

30+
31+
[cve_id]
32+
other = "CVE ID"
33+
34+
[cve_issue_url]
35+
other = "CVE Issue URL"
36+
37+
[cve_json_external_url]
38+
other = "external_url"
39+
40+
[cve_json_id]
41+
other = "id"
42+
43+
[cve_json_summary]
44+
other = "summary"
45+
46+
[cve_json_url]
47+
other = "url"
48+
49+
[cve_summary]
50+
other = "Issue Summary"
51+
52+
[cve_table]
53+
other = "Official Kubernetes CVE List"
54+
55+
[cve_url]
56+
other = "CVE URL"
57+
3058
[deprecation_title]
3159
other = "You are viewing documentation for Kubernetes version:"
3260

‎layouts/_default/cve-feed.json

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{
2+
"version": "https://jsonfeed.org/version/1.1",
3+
"title": "Auto-refreshing Official CVE Feed",
4+
"home_page_url": "https://kubernetes.io",
5+
"feed_url": "https://kubernetes.io/docs/reference/issues-security/official-cve-feed/index.json",
6+
"description": "Auto-refreshing official CVE feed for Kubernetes repository",
7+
"authors": [
8+
{
9+
"name": "Kubernetes Community",
10+
"url": "https://www.kubernetes.dev"
11+
}
12+
],
13+
"items": [
14+
{{ range $i, $e := getJSON .Site.Params.cveFeedBucket }}
15+
{{ if $i }}, {{ end }}
16+
{
17+
{{ T "cve_json_id" | jsonify }}: {{ .cve_id | jsonify }},
18+
{{ T "cve_json_url" | jsonify }}: {{ .issue_url | jsonify }},
19+
{{ T "cve_json_external_url" | jsonify }}: {{ .cve_url | jsonify}},
20+
{{ T "cve_json_summary" | jsonify }}: {{ replace (.summary | jsonify ) "\\u003e" ">" }}
21+
}{{ end }}
22+
]
23+
}

‎layouts/shortcodes/cve-feed.html

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<table class="security-cves">
2+
<caption>{{ T "cve_table" }}</caption>
3+
<thead>
4+
<tr>
5+
<th>{{ T "cve_id" }}</th>
6+
<th>{{ T "cve_summary"}}</th>
7+
<th>{{ T "cve_issue_url" }}</th>
8+
</tr>
9+
</thead>
10+
<tbody>
11+
{{ range $issues := getJSON .Site.Params.cveFeedBucket }}
12+
<tr>
13+
<td><a href="{{ .cve_url }}">{{ .cve_id | htmlEscape | safeHTML }}</a></td>
14+
<td>{{ .summary | htmlEscape | safeHTML }}</td>
15+
<td><a href="{{ .issue_url }}">#{{ .number }}</a></td>
16+
</tr>
17+
{{ end }}
18+
</tbody>
19+
</table>

0 commit comments

Comments
 (0)