Skip to content

Commit 8f24b49

Browse files
kakabishtkakabisht
committed
Making required fixes
1 parent 9354480 commit 8f24b49

File tree

2 files changed

+17
-11
lines changed
  • docs/16.security_advisories/01.security_advisories
  • versioned_docs/version-5.4/16.security_advisories/01.security_advisories

2 files changed

+17
-11
lines changed

‎docs/16.security_advisories/01.security_advisories/cve.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@ NeuVector is committed to informing the community of security issues. Below is a
44

55
## CVE List
66

7-
| ID | Description | Date | Resolution |
7+
| ID | Description | Date | Release |
88
| :---- | :---- | :---- | :---- |
99
| [CVE-2025-8077](https://github.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56) | For NeuVector deployment on the Kubernetes-based environment, the bootstrap password of the default admin user will be generated randomly and stored in a Kubernetes secret. The default admin will need to get the bootstrap password from the Kubernetes secret first and will be asked to change password after the first UI login is successful. | 25 Aug 2025 | [NeuVector v5.4.6](https://github.com/neuvector/neuvector/releases/tag/v5.4.6) |
1010
| [CVE-2025-53884](https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3) | NeuVector uses a cryptographically secure salt with the PBKDF2 algorithm instead of a simple hash to protect user passwords. For rolling upgrades from earlier versions, NeuVector recalculates and stores the new password hash only after each user’s next successful login. | 25 Aug 2025 | [NeuVector v5.4.6](https://github.com/neuvector/neuvector/releases/tag/v5.4.6) |
1111
| [CVE-2025-54467](https://github.com/neuvector/neuvector/security/advisories/GHSA-w54x-xfxg-4gxq) | By default, NeuVector redacts process commands that contain the strings password,passwd, pwd, token, or key in security logs, syslog, enforcer debug logs, controller debug logs, webhooks, and support logs. Users can configure a Kubernetes ConfigMap to define custom regex patterns for additional process commands to redact. | 25 Aug 2025 | [NeuVector v5.4.6](https://github.com/neuvector/neuvector/releases/tag/v5.4.6) |
12-
| [CVE-2025-46808](?) | Sensitive information may be logged in the manager container depending on logging configuration and credential permissions. For more information, refer to [ Sensitive information exposure in NeuVector manager container logs](#sensitive-information-exposure-in-neuvector-manager-container-logs) | ? | [NeuVector v5.4.5](https://github.com/neuvector/neuvector/releases/tag/v5.4.5) |
12+
| CVE-2025-46808 | Sensitive information may be logged in the manager container depending on logging configuration and credential permissions. For more information, refer to [ Sensitive information exposure in NeuVector manager container logs](#sensitive-information-exposure-in-neuvector-manager-container-logs) | 09 Jul 2025 | [NeuVector v5.4.5](https://github.com/neuvector/neuvector/releases/tag/v5.4.5) |
1313

1414

1515
| — | . Fixed in 5.4.5. | < 5.0.0 – 5.4.4
@@ -40,16 +40,17 @@ A vulnerability has been identified in the NeuVector version up to and including
4040
| public\_key | Verifier’s public key | Request body | Create/update verifier in Sigstore page | NeuVector |
4141

4242
:::note
43-
**Note:** NeuVector installations not using the single sign-on integration with Rancher Manager, and does not have Remote Repository Configuration enabled, are not affected by this issue.
43+
NeuVector installations that have the single sign-on integration with Rancher Manager and the Remote Repository Configuration disabled are not affected by this issue.
4444
:::
4545

46-
In the patched version, X-R-Sess is partially masked so that users can confirm what it is being used while still keeping it safe for consumption. The log which includes `personal_access_token`, `token`, `rekor_public_key`, `root_cert`, `sct_public_key`, `public key` are removed, as the request body is not mandatory in the log.
46+
In the patched version, X-R-Sess is partially masked so that users can confirm what is being used while still keeping it safe for consumption. The log, which includes `personal_access_token`, `token`, `rekor_public_key`, `root_cert`, `sct_public_key`, and `public key` are removed, as the request body is not mandatory in the log.
4747

4848
:::note
4949
* The severity of the vulnerability depends on your logging strategy.
5050
* **Local logging (default)**: Limits exposure of impact.
5151
* **External logging**: Vulnerability’s severity increases, the impact depends on security measures implemented at the external log collector level.
5252
* The final impact severity for confidentiality, integrity and availability is dependent on the permissions that the leaked credentials have on their own services.
53+
:::
5354

5455
Please consult the associated [Unsecured credentials](https://attack.mitre.org/techniques/T1552/) for further information about this category of attack.
5556

@@ -66,5 +67,5 @@ No workarounds are currently available. Customers are advised to upgrade to a fi
6667
* Contact the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy).
6768
* Open an issue in the [NeuVector GitHub repository](https://github.com/neuvector/neuvector/issues/new/choose).
6869
* References:
69-
** [NeuVector Support Matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/)
70-
** [Product Support Lifecycle](https://www.suse.com/lifecycle/#suse-security)
70+
* [NeuVector Support Matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/)
71+
* [Product Support Lifecycle](https://www.suse.com/lifecycle/#suse-security)

‎versioned_docs/version-5.4/16.security_advisories/01.security_advisories/cve.md‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,12 @@ NeuVector is committed to informing the community of security issues. Below is a
77
| ID | Description | Date | Release |
88
| :---- | :---- | :---- | :---- |
99
| [CVE-2025-8077](https://github.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56) | For NeuVector deployment on the Kubernetes-based environment, the bootstrap password of the default admin user will be generated randomly and stored in a Kubernetes secret. The default admin will need to get the bootstrap password from the Kubernetes secret first and will be asked to change password after the first UI login is successful. | 25 Aug 2025 | [NeuVector v5.4.6](https://github.com/neuvector/neuvector/releases/tag/v5.4.6) |
10-
| [CVE-2025-53884](https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3) | NeuVector uses a cryptographically secure salt with the PBKDF2 algorithm instead of a simple hash to protect user passwords.For rolling upgrades from earlier versions, NeuVector recalculates and stores the new password hash only after each user’s next successful login. | 25 Aug 2025 | [NeuVector v5.4.6](https://github.com/neuvector/neuvector/releases/tag/v5.4.6) |
10+
| [CVE-2025-53884](https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3) | NeuVector uses a cryptographically secure salt with the PBKDF2 algorithm instead of a simple hash to protect user passwords. For rolling upgrades from earlier versions, NeuVector recalculates and stores the new password hash only after each user’s next successful login. | 25 Aug 2025 | [NeuVector v5.4.6](https://github.com/neuvector/neuvector/releases/tag/v5.4.6) |
1111
| [CVE-2025-54467](https://github.com/neuvector/neuvector/security/advisories/GHSA-w54x-xfxg-4gxq) | By default, NeuVector redacts process commands that contain the strings password,passwd, pwd, token, or key in security logs, syslog, enforcer debug logs, controller debug logs, webhooks, and support logs. Users can configure a Kubernetes ConfigMap to define custom regex patterns for additional process commands to redact. | 25 Aug 2025 | [NeuVector v5.4.6](https://github.com/neuvector/neuvector/releases/tag/v5.4.6) |
12+
| CVE-2025-46808 | Sensitive information may be logged in the manager container depending on logging configuration and credential permissions. For more information, refer to [ Sensitive information exposure in NeuVector manager container logs](#sensitive-information-exposure-in-neuvector-manager-container-logs) | 09 Jul 2025 | [NeuVector v5.4.5](https://github.com/neuvector/neuvector/releases/tag/v5.4.5) |
13+
14+
15+
| — | . Fixed in 5.4.5. | < 5.0.0 – 5.4.4
1216

1317
## Sensitive information exposure in NeuVector manager container logs
1418

@@ -36,16 +40,17 @@ A vulnerability has been identified in the NeuVector version up to and including
3640
| public\_key | Verifier’s public key | Request body | Create/update verifier in Sigstore page | NeuVector |
3741

3842
:::note
39-
**Note:** NeuVector installations not using the single sign-on integration with Rancher Manager, and does not have Remote Repository Configuration enabled, are not affected by this issue.
43+
NeuVector installations that have the single sign-on integration with Rancher Manager and the Remote Repository Configuration disabled are not affected by this issue.
4044
:::
4145

42-
In the patched version, X-R-Sess is partially masked so that users can confirm what it is being used while still keeping it safe for consumption. The log which includes `personal_access_token`, `token`, `rekor_public_key`, `root_cert`, `sct_public_key`, `public key` are removed, as the request body is not mandatory in the log.
46+
In the patched version, X-R-Sess is partially masked so that users can confirm what is being used while still keeping it safe for consumption. The log, which includes `personal_access_token`, `token`, `rekor_public_key`, `root_cert`, `sct_public_key`, and `public key` are removed, as the request body is not mandatory in the log.
4347

4448
:::note
4549
* The severity of the vulnerability depends on your logging strategy.
4650
* **Local logging (default)**: Limits exposure of impact.
4751
* **External logging**: Vulnerability’s severity increases, the impact depends on security measures implemented at the external log collector level.
4852
* The final impact severity for confidentiality, integrity and availability is dependent on the permissions that the leaked credentials have on their own services.
53+
:::
4954

5055
Please consult the associated [Unsecured credentials](https://attack.mitre.org/techniques/T1552/) for further information about this category of attack.
5156

@@ -62,5 +67,5 @@ No workarounds are currently available. Customers are advised to upgrade to a fi
6267
* Contact the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy).
6368
* Open an issue in the [NeuVector GitHub repository](https://github.com/neuvector/neuvector/issues/new/choose).
6469
* References:
65-
** [NeuVector Support Matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/)
66-
** [Product Support Lifecycle](https://www.suse.com/lifecycle/#suse-security)
70+
* [NeuVector Support Matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/)
71+
* [Product Support Lifecycle](https://www.suse.com/lifecycle/#suse-security)

0 commit comments

Comments
 (0)