Handling of vulnerabilities in xWiki

[Beat_Burgener]

Hello there

Maybe I miss something, just learned via a security service about the CVE-2024-41947

Looking at https://dev.xwiki.org/xwiki/bin/view/Community/SecurityPolicy/ and Security Overview · xwiki/xwiki-platform · GitHub

I see a potential gap for the xWiki user base between the discovery, fix and publication of the CVE.

Maybe there is a way to be made aware that there is a vulnerability in version X.Y.Z that was fixed in version A.B.C, but I was not successful in finding it.

For me, it would be good to know / be made aware of

a) if a security issue was discovered in version X.Y.Z and the severity of it (without the details but with the internal CVE identifier)

b) in which version of xWiki a CVE was fixed (relating the CVE ID)

Otherwise there might be a gap of at least 3 month between the fix and the awareness of a CVE by the user base.

If there is a resource to fill that gap, please point it out to me.

Thank you

PS: Sure, one might protect the xWiki instance with per-authentication reducing the attack surface - which is what we start to do with many of our services - but which is not feasible for all xWiki users out there.

[vmassol]

@Beat_Burgener

I see a potential gap for the xWiki user base between the discovery, fix and publication of the CVE.

Maybe there is a way to be made aware that there is a vulnerability in version X.Y.Z that was fixed in version A.B.C, but I was not successful in finding it.

The answer is at https://dev.xwiki.org/xwiki/bin/view/Community/SecurityPolicy/#HWhataretheavailablechannelstodiscussaboutsecurityissues3F and steps 4/5/6 of https://dev.xwiki.org/xwiki/bin/view/Community/SecurityPolicy/#HWhat2019stheprocesstohandlesecurityissuesforcommitters3F

We cannot publicly disclose the issue without first fixing it and giving time for xwiki admins to upgrade… Hence the private channels.

@Beat_Burgener

a) if a security issue was discovered in version X.Y.Z and the severity of it (without the details but with the internal CVE identifier)

There’s no internal CVE before the end, see step 8 at https://dev.xwiki.org/xwiki/bin/view/Community/SecurityPolicy/#HWhat2019stheprocesstohandlesecurityissuesforcommitters3F

What you mean probably is more the GH advisory.

So to be more clear, since we cannot disclose the issue publicly you need to ask to be on the internal security channels and for us to accept you we need to make some due diligence to know who you are.

Note that in each release note, we disclose if there are security issues fixed and the highest severity, see for example https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.5.0/

If you have ideas on how we could improve this further let us know!