Open Stack

Hi OpenStack community,

I’m working on OpenStack project under my employee company.
In OpenStack, few of projects (e.g. Cinder and Ironic) uses vendor supplied library in it.
This means vendor-neutral base code of project is hosted under OpenStack project repository
but vendor hardware specific logic is delegated to vendor library which is called by base code
and is maintained by each hardware vendor under their repository.

In the past, I faced situation to handle vulnerability in which cause of vulnerability is in
vendor library but, to handle vulnerability, both OpenStack code and vendor library code
should be modified.
To handle this, I consulted community member and asked them to coordinate to fix vulnerability
in private way (i.e. review patch and prepare commit in not public but private as usual security
handling manner). However member are not willing to working on together because cause of
vulnerability is in vendor provided library.
I felt it’s better for community to, at least, be open to working on such vulnerability because that policy
may benefit community. So I think it’s better to include policy in VMT document[1] like
“Community is encouraged to make effort to be open to handling vulnerability in which both
OpenStack community code and vendor provided code should be modified”.

How do you think about this?

Regards,
Vanou Ishii

[1] https://security.openstack.org/vmt-process.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.openstack.org/pipermail/openstack-discuss/attachments/20230418/ca1b8ab2/attachment-0001.htm>