From e9816a7d4665e673dd4833394f19fc9fdae56fe4 Mon Sep 17 00:00:00 2001 From: Tostti Date: Thu, 7 Mar 2024 12:51:11 -0300 Subject: [PATCH 01/15] Support Wazuh 5.0.0 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f5f5958d..c57fbf37 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ "templateVersion": "2.16.0" }, "wazuh": { - "version": "4.10.0", + "version": "5.0.0", "revision": "00" }, "license": "Apache-2.0", From c24358525af73882f4e00b2fc8880cfafbec4dca Mon Sep 17 00:00:00 2001 From: Nicolas Agustin Guevara Pihen <42900763+Tostti@users.noreply.github.com> Date: Thu, 17 Oct 2024 13:11:04 -0300 Subject: [PATCH 02/15] Merge 4.9.1 into 4.10.0 (#102) (#121) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * 2.13 release notes (#1832) (#1837) * 2.13 release notes * Fix style and package * Fix style and package * Fix link --------- (cherry picked from commit 7c8058f376d235d651f76552d9bdd12840ebd329) * Add required ml permissions to support new roles (#1838) (#1844) * Add required ml permissions to support new roles * Add ml permissions * Remove internal ml action permissions * Add back internal ml action permissions --------- (cherry picked from commit f0cd1cf8cb6c11074ebdcd2dbea4604b0654decf) * Add compatibility with OpenSearch 2.11.0 (#31) * Bump version Security Dashboards Plugin 2.9.0.0 (#21) * Upgrade to version 2.8.0 of Security Dashboards Plugin (#20) * Patch actions and workflows. Skip integration tests that fail (#4) * Change plugin name in actions and workflows * Patch install-dashboards action * Change jest config path * Skip tests --------- * Change Wazuh logo and titles (#3) * Change Wazuh logo and titles * Don't force custom logo to have 100% width * Add comment * Fix lint * Fix prettier * Update snapshots --------- * Disable tenant popup (#5) * Replace readme (#16) * Replace readme * Replace Opensearch to Wazuh * Update README.md --------- * Add GitHub workflow for automated build (#15) * Manual build * Workflow for automated build * Update .github/workflows/dev-environment.yml --------- * Create codeql.yml * Revert changes in cypress-test.yml * Revert changes in integration-test.yml * Fix integration test * Fix cypress test tenancy disabled --------- * Skip overview page test * Skip test for issue * Skip test for issue --------- * Fix home image and lint * Fix lint * Fix snapshot * Fix integration test * Revert selector --------- * Update of the GitHub actions to create the packages (#33) * Update Build manual Github action * Add wazuh version in package.json * Update package.json --------- * Change order of security in left menu (#36) * Change order of security in left menu * Fix cypress test * Fix repository tests (#46) * Initial commit * Removed Windows and Mac tests * Fix oidc test * Fix SAML test * Bump 4.9.0 to revision 01 (#56) * chore: bump 4.9.0 revision 02 (#64) * Bump revision 03 (#74) * chore: bump to 4.9.1 revision 00 (#76) * Update the security policy (#95) * change: update the security policy * fix: security policy * Update repository security policy (#97) * chore(bump): revision 4.9.1 01 (#99) --------- Signed-off-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com> Signed-off-by: Álex Ruiz Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com> Co-authored-by: opensearch-trigger-bot[bot] <98922864+opensearch-trigger-bot[bot]@users.noreply.github.com> Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com> Co-authored-by: Sicheng Song Co-authored-by: Álex Ruiz Co-authored-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com> Co-authored-by: Federico Rodriguez Co-authored-by: yenienserrano --- SECURITY.md | 46 ++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 44 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 9c817530..164723b5 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,45 @@ -# Reporting a Vulnerability +# Wazuh Open Source Project Security Policy -If you discover a potential security issue in this project we ask that you notify OpenSearch Security directly via email to security@opensearch.org. Please do **not** create a public GitHub issue. +Version: 2023-06-12 + +## Introduction +This document outlines the Security Policy for Wazuh's open source projects. It emphasizes our commitment to maintain a secure environment for our users and contributors, and reflects our belief in the power of collaboration to identify and resolve security vulnerabilities. + +## Scope +This policy applies to all open source projects developed, maintained, or hosted by Wazuh. + +## Reporting Security Vulnerabilities +If you believe you've discovered a potential security vulnerability in one of our open source projects, we strongly encourage you to report it to us responsibly. + +Please submit your findings as security advisories under the "Security" tab in the relevant GitHub repository. Alternatively, you may send the details of your findings to [security@wazuh.com](mailto:security@wazuh.com). + +## Vulnerability Disclosure Policy +Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps: + +1. Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation. +2. Validation: We will validate the issue and work on reproducing it in our environment. +3. Remediation: We will work on a fix and thoroughly test it +4. Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party. +5. Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments. + +This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability. + +## Automatic Scanning +We leverage GitHub Actions to perform automated scans of our supply chain. These scans assist us in identifying vulnerabilities and outdated dependencies in a proactive and timely manner. + +## Credit +We believe in giving credit where credit is due. If you report a security vulnerability to us, and we determine that it is a valid vulnerability, we will publicly credit you for the discovery when we disclose the vulnerability. If you wish to remain anonymous, please indicate so in your initial report. + +We do appreciate and encourage feedback from our community, but currently we do not have a bounty program. We might start bounty programs in the future. + +## Compliance with this Policy +We consider the discovery and reporting of security vulnerabilities an important public service. We encourage responsible reporting of any vulnerabilities that may be found in our site or applications. + +Furthermore, we will not take legal action against or suspend or terminate access to the site or services of those who discover and report security vulnerabilities in accordance with this policy because of the fact. + +We ask that all users and contributors respect this policy and the security of our community's users by disclosing vulnerabilities to us in accordance with this policy. + +## Changes to this Security Policy +This policy may be revised from time to time. Each version of the policy will be identified at the top of the page by its effective date. + +If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com) From 16ca94bd5cf219f60ce723b3d7bca6a5eb7606a1 Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 14:32:46 -0300 Subject: [PATCH 03/15] Update all workflows to use actions/checkout@v4 for improved compatibility and performance --- .github/workflows/auto-release.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/cypress-test-multiauth-e2e.yml | 2 +- .../workflows/cypress-test-multidatasources-disabled-e2e.yml | 2 +- .github/workflows/cypress-test-multidatasources-enabled-e2e.yml | 2 +- .github/workflows/cypress-test-oidc-e2e.yml | 2 +- .github/workflows/cypress-test-saml-e2e.yml | 2 +- .github/workflows/cypress-test-tenancy-disabled.yml | 2 +- .github/workflows/cypress-test.yml | 2 +- .github/workflows/dev-environment.yml | 2 +- .github/workflows/integration-test.yml | 2 +- .github/workflows/unit-test.yml | 2 +- .github/workflows/verify-binary-installation.yml | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 61518c10..5cad7c43 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -22,7 +22,7 @@ jobs: - name: Get tag id: tag uses: dawidd6/action-get-tag@v1 - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - uses: ncipollo/release-action@v1 with: github_token: ${{ steps.github_app_token.outputs.token }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 092c298a..8c7e9146 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/cypress-test-multiauth-e2e.yml b/.github/workflows/cypress-test-multiauth-e2e.yml index bb7985f9..fb6d7207 100644 --- a/.github/workflows/cypress-test-multiauth-e2e.yml +++ b/.github/workflows/cypress-test-multiauth-e2e.yml @@ -22,7 +22,7 @@ jobs: steps: - name: Checkout Branch - uses: actions/checkout@v3 + uses: actions/checkout@v4 # Add SAML Configuration - name: Injecting SAML Configuration for Linux diff --git a/.github/workflows/cypress-test-multidatasources-disabled-e2e.yml b/.github/workflows/cypress-test-multidatasources-disabled-e2e.yml index e41de5fa..17381a99 100644 --- a/.github/workflows/cypress-test-multidatasources-disabled-e2e.yml +++ b/.github/workflows/cypress-test-multidatasources-disabled-e2e.yml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout Branch - uses: actions/checkout@v3 + uses: actions/checkout@v4 # Configure the Dashboard for multi datasources disabled (default) - name: Create OpenSearch Dashboards Config diff --git a/.github/workflows/cypress-test-multidatasources-enabled-e2e.yml b/.github/workflows/cypress-test-multidatasources-enabled-e2e.yml index 162941cf..3b9fcdce 100644 --- a/.github/workflows/cypress-test-multidatasources-enabled-e2e.yml +++ b/.github/workflows/cypress-test-multidatasources-enabled-e2e.yml @@ -21,7 +21,7 @@ jobs: steps: - name: Checkout Branch - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Set env run: | diff --git a/.github/workflows/cypress-test-oidc-e2e.yml b/.github/workflows/cypress-test-oidc-e2e.yml index d02b3f8a..6d6f622e 100644 --- a/.github/workflows/cypress-test-oidc-e2e.yml +++ b/.github/workflows/cypress-test-oidc-e2e.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout Branch - uses: actions/checkout@v3 + uses: actions/checkout@v4 # Download and Check Keycloak Version - name: Download and Check Keyloak Version on Linux diff --git a/.github/workflows/cypress-test-saml-e2e.yml b/.github/workflows/cypress-test-saml-e2e.yml index 292cb2fe..0f09d0c4 100644 --- a/.github/workflows/cypress-test-saml-e2e.yml +++ b/.github/workflows/cypress-test-saml-e2e.yml @@ -22,7 +22,7 @@ jobs: steps: - name: Checkout Branch - uses: actions/checkout@v3 + uses: actions/checkout@v4 # Add SAML Configuration - name: Create SAML Configuration for Linux diff --git a/.github/workflows/cypress-test-tenancy-disabled.yml b/.github/workflows/cypress-test-tenancy-disabled.yml index 18389e70..7eeb3509 100644 --- a/.github/workflows/cypress-test-tenancy-disabled.yml +++ b/.github/workflows/cypress-test-tenancy-disabled.yml @@ -28,7 +28,7 @@ jobs: java-version: 11 - name: Checkout Branch - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Set env run: | diff --git a/.github/workflows/cypress-test.yml b/.github/workflows/cypress-test.yml index 408cb996..fa27bfc6 100644 --- a/.github/workflows/cypress-test.yml +++ b/.github/workflows/cypress-test.yml @@ -28,7 +28,7 @@ jobs: java-version: 11 - name: Checkout Branch - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Set env run: | diff --git a/.github/workflows/dev-environment.yml b/.github/workflows/dev-environment.yml index 7bcec241..9c5f041b 100644 --- a/.github/workflows/dev-environment.yml +++ b/.github/workflows/dev-environment.yml @@ -47,7 +47,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Step 01 - Download the plugin's source code - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: repository: wazuh/wazuh-security-dashboards-plugin ref: ${{ inputs.reference }} diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml index 7b5a646b..21cb44a8 100644 --- a/.github/workflows/integration-test.yml +++ b/.github/workflows/integration-test.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout Branch - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Set up JDK uses: actions/setup-java@v1 diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index bd104510..ec0eaf1d 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -17,7 +17,7 @@ jobs: # run: git config --system core.longpaths true - name: Checkout Branch - uses: actions/checkout@v2 + uses: actions/checkout@v4 - id: install-dashboards uses: derek-ho/setup-opensearch-dashboards@v3 diff --git a/.github/workflows/verify-binary-installation.yml b/.github/workflows/verify-binary-installation.yml index 7718b690..c4125022 100644 --- a/.github/workflows/verify-binary-installation.yml +++ b/.github/workflows/verify-binary-installation.yml @@ -20,7 +20,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Checkout Branch - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Set env run: | From 3f9c581e3ceae6f9fa834703744aae2237bbe274 Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 14:47:16 -0300 Subject: [PATCH 04/15] Update GitHub workflows to use actions/setup-java@v4 with Temurin distribution for better support and performance --- .github/actions/run-cypress-tests/action.yml | 3 ++- .github/workflows/cypress-test-tenancy-disabled.yml | 3 ++- .github/workflows/cypress-test.yml | 3 ++- .github/workflows/integration-test.yml | 3 ++- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/actions/run-cypress-tests/action.yml b/.github/actions/run-cypress-tests/action.yml index d77adf5a..a898b763 100644 --- a/.github/actions/run-cypress-tests/action.yml +++ b/.github/actions/run-cypress-tests/action.yml @@ -20,8 +20,9 @@ runs: using: "composite" steps: - name: Set up JDK - uses: actions/setup-java@v1 + uses: actions/setup-java@v4 with: + distribution: 'temurin' java-version: 11 - name: Set env diff --git a/.github/workflows/cypress-test-tenancy-disabled.yml b/.github/workflows/cypress-test-tenancy-disabled.yml index 7eeb3509..f4971e25 100644 --- a/.github/workflows/cypress-test-tenancy-disabled.yml +++ b/.github/workflows/cypress-test-tenancy-disabled.yml @@ -23,8 +23,9 @@ jobs: steps: - name: Set up JDK - uses: actions/setup-java@v1 + uses: actions/setup-java@v4 with: + distribution: 'temurin' java-version: 11 - name: Checkout Branch diff --git a/.github/workflows/cypress-test.yml b/.github/workflows/cypress-test.yml index fa27bfc6..f077c033 100644 --- a/.github/workflows/cypress-test.yml +++ b/.github/workflows/cypress-test.yml @@ -23,8 +23,9 @@ jobs: steps: - name: Set up JDK - uses: actions/setup-java@v1 + uses: actions/setup-java@v4 with: + distribution: 'temurin' java-version: 11 - name: Checkout Branch diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml index 21cb44a8..4118fc05 100644 --- a/.github/workflows/integration-test.yml +++ b/.github/workflows/integration-test.yml @@ -22,8 +22,9 @@ jobs: uses: actions/checkout@v4 - name: Set up JDK - uses: actions/setup-java@v1 + uses: actions/setup-java@v4 with: + distribution: 'temurin' java-version: 11 - name: Set env From 9244ba7abc071759dfb8f59354b1ddccdef05e2e Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 14:49:51 -0300 Subject: [PATCH 05/15] Update workflows to use derek-ho/start-opensearch@v6 for enhanced features and compatibility across all GitHub actions --- .github/actions/run-cypress-tests/action.yml | 2 +- .../workflows/cypress-test-multidatasources-enabled-e2e.yml | 2 +- .github/workflows/cypress-test-tenancy-disabled.yml | 2 +- .github/workflows/cypress-test.yml | 2 +- .github/workflows/integration-test.yml | 4 ++-- .github/workflows/verify-binary-installation.yml | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/actions/run-cypress-tests/action.yml b/.github/actions/run-cypress-tests/action.yml index a898b763..958ae401 100644 --- a/.github/actions/run-cypress-tests/action.yml +++ b/.github/actions/run-cypress-tests/action.yml @@ -42,7 +42,7 @@ runs: download-location: ${{ env.PLUGIN_NAME }} - name: Run Opensearch with A Single Plugin - uses: derek-ho/start-opensearch@v2 + uses: derek-ho/start-opensearch@v6 with: opensearch-version: ${{ env.OPENSEARCH_VERSION }} plugins: "file:$(pwd)/opensearch-security.zip" diff --git a/.github/workflows/cypress-test-multidatasources-enabled-e2e.yml b/.github/workflows/cypress-test-multidatasources-enabled-e2e.yml index 3b9fcdce..8ec05496 100644 --- a/.github/workflows/cypress-test-multidatasources-enabled-e2e.yml +++ b/.github/workflows/cypress-test-multidatasources-enabled-e2e.yml @@ -67,7 +67,7 @@ jobs: download-location: ${{env.PLUGIN_NAME}} - name: Run Opensearch with A Single Plugin - uses: derek-ho/start-opensearch@v4 + uses: derek-ho/start-opensearch@v6 with: opensearch-version: ${{ env.OPENSEARCH_VERSION }} plugins: "file:$(pwd)/opensearch-security.zip" diff --git a/.github/workflows/cypress-test-tenancy-disabled.yml b/.github/workflows/cypress-test-tenancy-disabled.yml index f4971e25..2c8aeea7 100644 --- a/.github/workflows/cypress-test-tenancy-disabled.yml +++ b/.github/workflows/cypress-test-tenancy-disabled.yml @@ -48,7 +48,7 @@ jobs: download-location: ${{ env.PLUGIN_NAME }} - name: Run Opensearch with security - uses: derek-ho/start-opensearch@v2 + uses: derek-ho/start-opensearch@v6 with: opensearch-version: ${{ env.OPENSEARCH_VERSION }} plugins: 'file:$(pwd)/${{ env.PLUGIN_NAME }}.zip' diff --git a/.github/workflows/cypress-test.yml b/.github/workflows/cypress-test.yml index f077c033..9d2b2920 100644 --- a/.github/workflows/cypress-test.yml +++ b/.github/workflows/cypress-test.yml @@ -48,7 +48,7 @@ jobs: download-location: ${{ env.PLUGIN_NAME }} - name: Run Opensearch with security - uses: derek-ho/start-opensearch@v2 + uses: derek-ho/start-opensearch@v6 with: opensearch-version: ${{ env.OPENSEARCH_VERSION }} plugins: 'file:$(pwd)/${{ env.PLUGIN_NAME }}.zip' diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml index 4118fc05..bf03c72d 100644 --- a/.github/workflows/integration-test.yml +++ b/.github/workflows/integration-test.yml @@ -70,7 +70,7 @@ jobs: plugin-version: ${{ env.PLUGIN_VERSION }} - name: Run Opensearch with A Single Plugin Remote Cluster - uses: derek-ho/start-opensearch@v4 + uses: derek-ho/start-opensearch@v6 with: opensearch-version: ${{ env.OPENSEARCH_VERSION }} plugins: "file:$(pwd)/opensearch-security-${{ env.OPENSEARCH_VERSION }}.zip" @@ -85,7 +85,7 @@ jobs: shell: bash - name: Run Opensearch with security - uses: derek-ho/start-opensearch@v2 + uses: derek-ho/start-opensearch@v6 with: opensearch-version: ${{ env.OPENSEARCH_VERSION }} plugins: 'file:$(pwd)/${{ env.PLUGIN_NAME }}.zip' diff --git a/.github/workflows/verify-binary-installation.yml b/.github/workflows/verify-binary-installation.yml index c4125022..d0af3d72 100644 --- a/.github/workflows/verify-binary-installation.yml +++ b/.github/workflows/verify-binary-installation.yml @@ -39,7 +39,7 @@ jobs: download-location: ${{ env.PLUGIN_NAME }} - name: Run Opensearch with security - uses: derek-ho/start-opensearch@v2 + uses: derek-ho/start-opensearch@v6 with: opensearch-version: ${{ env.OPENSEARCH_VERSION }} plugins: "file:$(pwd)/${{ env.PLUGIN_NAME }}.zip" From fed73e4d5d79f45dbb1c93aece11b369f0a1263e Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 14:50:48 -0300 Subject: [PATCH 06/15] Update workflows to use derek-ho/setup-opensearch-dashboards@v3 for better features and compatibility across all GitHub actions --- .github/actions/run-cypress-tests/action.yml | 2 +- .github/workflows/cypress-test-tenancy-disabled.yml | 2 +- .github/workflows/cypress-test.yml | 2 +- .github/workflows/verify-binary-installation.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/actions/run-cypress-tests/action.yml b/.github/actions/run-cypress-tests/action.yml index 958ae401..4781d446 100644 --- a/.github/actions/run-cypress-tests/action.yml +++ b/.github/actions/run-cypress-tests/action.yml @@ -52,7 +52,7 @@ runs: # OSD bootstrap - name: Run Dashboard with Security Dashboards Plugin - uses: derek-ho/setup-opensearch-dashboards@v1 + uses: derek-ho/setup-opensearch-dashboards@v3 with: plugin_name: security-dashboards-plugin opensearch_dashboards_yml: ${{ inputs.dashboards_config_file }} diff --git a/.github/workflows/cypress-test-tenancy-disabled.yml b/.github/workflows/cypress-test-tenancy-disabled.yml index 2c8aeea7..6cdb7472 100644 --- a/.github/workflows/cypress-test-tenancy-disabled.yml +++ b/.github/workflows/cypress-test-tenancy-disabled.yml @@ -71,7 +71,7 @@ jobs: EOT - name: Run Dashboard with Security Dashboards Plugin - uses: derek-ho/setup-opensearch-dashboards@v1 + uses: derek-ho/setup-opensearch-dashboards@v3 with: plugin_name: security-dashboards-plugin app_reference: ${{ vars.WZD_REF }} diff --git a/.github/workflows/cypress-test.yml b/.github/workflows/cypress-test.yml index 9d2b2920..218e716d 100644 --- a/.github/workflows/cypress-test.yml +++ b/.github/workflows/cypress-test.yml @@ -73,7 +73,7 @@ jobs: EOT - name: Run Dashboard with Security Dashboards Plugin - uses: derek-ho/setup-opensearch-dashboards@v1 + uses: derek-ho/setup-opensearch-dashboards@v3 with: plugin_name: security-dashboards-plugin app_reference: ${{ vars.WZD_REF }} diff --git a/.github/workflows/verify-binary-installation.yml b/.github/workflows/verify-binary-installation.yml index d0af3d72..5827e460 100644 --- a/.github/workflows/verify-binary-installation.yml +++ b/.github/workflows/verify-binary-installation.yml @@ -67,7 +67,7 @@ jobs: - name: Run Dashboard with Security Dashboards Plugin id: setup-dashboards - uses: derek-ho/setup-opensearch-dashboards@v2 + uses: derek-ho/setup-opensearch-dashboards@v3 with: plugin_name: security-dashboards-plugin built_plugin_name: security-dashboards From a3804d45e9ca07a191cebd0f97b1cd0c2e03614c Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 14:52:58 -0300 Subject: [PATCH 07/15] Update workflows to use tibdex/github-app-token@v2.1.0 for improved installation retrieval method and enhanced functionality --- .github/workflows/auto-release.yml | 7 +++++-- .github/workflows/backport.yml | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 5cad7c43..82a0f4d9 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -14,11 +14,14 @@ jobs: steps: - name: GitHub App token id: github_app_token - uses: tibdex/github-app-token@v1.5.0 + uses: tibdex/github-app-token@v2.1.0 with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} - installation_id: 22958780 + # https://github.com/tibdex/github-app-token/releases/tag/v2.0.0 + # https://github.com/tibdex/github-app-token/compare/v1.5.0...v2.1.0#diff-1243c5424efaaa19bd8e813c5e6f6da46316e63761421b3e5f5c8ced9a36e6b6R11-R30 + installation_retrieval_mode: id + installation_retrieval_payload: 22958780 - name: Get tag id: tag uses: dawidd6/action-get-tag@v1 diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index e47d8d88..87069a71 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -15,11 +15,14 @@ jobs: steps: - name: GitHub App token id: github_app_token - uses: tibdex/github-app-token@v1.5.0 + uses: tibdex/github-app-token@v2.1.0 with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} - installation_id: 22958780 + # https://github.com/tibdex/github-app-token/releases/tag/v2.0.0 + # https://github.com/tibdex/github-app-token/compare/v1.5.0...v2.1.0#diff-1243c5424efaaa19bd8e813c5e6f6da46316e63761421b3e5f5c8ced9a36e6b6R11-R30 + installation_retrieval_mode: id + installation_retrieval_payload: 22958780 - name: Backport uses: VachaShah/backport@v1.1.4 From 37ce89572f8e4e906c34918de3fce48aecd1cccb Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 14:54:59 -0300 Subject: [PATCH 08/15] Update workflows to use actions/upload-artifact@v4 for improved artifact upload and added overwrite functionality --- .github/workflows/dev-environment.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dev-environment.yml b/.github/workflows/dev-environment.yml index 9c5f041b..332765b1 100644 --- a/.github/workflows/dev-environment.yml +++ b/.github/workflows/dev-environment.yml @@ -82,10 +82,11 @@ jobs: - name: Step 04 - Upload artifact to GitHub if: ${{ inputs.artifact_name && inputs.artifact_path }} - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: ${{ inputs.artifact_name }}_${{ env.version }}-${{ env.revision }}_${{ inputs.reference }}.zip path: ${{ inputs.artifact_path }} + overwrite: true - name: Step 05 - Upload coverage results to GitHub if: ${{ inputs.notify_jest_coverage_summary && github.event_name == 'pull_request' }} From 128ca85507f059a11fc3c29ec75bf680cc524939 Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 14:59:24 -0300 Subject: [PATCH 09/15] Update run-cypress-tests action to use Wandalen/wretry.action@v3 for improved reliability in test retries --- .github/actions/run-cypress-tests/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/run-cypress-tests/action.yml b/.github/actions/run-cypress-tests/action.yml index 4781d446..c2d80588 100644 --- a/.github/actions/run-cypress-tests/action.yml +++ b/.github/actions/run-cypress-tests/action.yml @@ -99,7 +99,7 @@ runs: shell: bash - name: Run Cypress Tests with retry - uses: Wandalen/wretry.action@v3.3.0 + uses: Wandalen/wretry.action@v3 with: attempt_limit: 5 attempt_delay: 2000 From 1de4f37a9c5838f585c77775b465d3ea09aaf18b Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 15:00:02 -0300 Subject: [PATCH 10/15] Update backport workflow to use VachaShah/backport@v2 for enhanced features and improved functionality in backporting changes --- .github/workflows/backport.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 87069a71..7fcf78ea 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -25,7 +25,7 @@ jobs: installation_retrieval_payload: 22958780 - name: Backport - uses: VachaShah/backport@v1.1.4 + uses: VachaShah/backport@v2 with: github_token: ${{ steps.github_app_token.outputs.token }} branch_name: backport/backport-${{ github.event.number }} From 407e067e4c6e58c423d169cb7d76bd9577ff1707 Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 15:36:23 -0300 Subject: [PATCH 11/15] Update Wazuh version to 4.10.0 with revision 03 --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index c57fbf37..ad023f8e 100644 --- a/package.json +++ b/package.json @@ -7,8 +7,8 @@ "templateVersion": "2.16.0" }, "wazuh": { - "version": "5.0.0", - "revision": "00" + "version": "4.10.0", + "revision": "03" }, "license": "Apache-2.0", "homepage": "https://github.com/opensearch-project/security-dashboards-plugin", From 27799adfc05ce84dfcd7b57a562a8c9556e7a798 Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 15:38:15 -0300 Subject: [PATCH 12/15] Update Wazuh revision to "00" in package.json --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index ad023f8e..bf96caf4 100644 --- a/package.json +++ b/package.json @@ -8,7 +8,7 @@ }, "wazuh": { "version": "4.10.0", - "revision": "03" + "revision": "00" }, "license": "Apache-2.0", "homepage": "https://github.com/opensearch-project/security-dashboards-plugin", @@ -60,4 +60,4 @@ "express": "^4.19.2", "braces": "^3.0.3" } -} \ No newline at end of file +} From 406e15a9cc7e60226e3f8e35043447f37a9fbf8f Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 15:41:11 -0300 Subject: [PATCH 13/15] Fix missing newline at end of package.json file --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index bf96caf4..f5f5958d 100644 --- a/package.json +++ b/package.json @@ -60,4 +60,4 @@ "express": "^4.19.2", "braces": "^3.0.3" } -} +} \ No newline at end of file From f498fa9163c1e95c23ba582933dcdfaaaae1da47 Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 15:48:24 -0300 Subject: [PATCH 14/15] Update SECURITY.md to redirect vulnerability reports to OpenSearch Security via email --- SECURITY.md | 46 ++-------------------------------------------- 1 file changed, 2 insertions(+), 44 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 164723b5..9c817530 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,45 +1,3 @@ -# Wazuh Open Source Project Security Policy +# Reporting a Vulnerability -Version: 2023-06-12 - -## Introduction -This document outlines the Security Policy for Wazuh's open source projects. It emphasizes our commitment to maintain a secure environment for our users and contributors, and reflects our belief in the power of collaboration to identify and resolve security vulnerabilities. - -## Scope -This policy applies to all open source projects developed, maintained, or hosted by Wazuh. - -## Reporting Security Vulnerabilities -If you believe you've discovered a potential security vulnerability in one of our open source projects, we strongly encourage you to report it to us responsibly. - -Please submit your findings as security advisories under the "Security" tab in the relevant GitHub repository. Alternatively, you may send the details of your findings to [security@wazuh.com](mailto:security@wazuh.com). - -## Vulnerability Disclosure Policy -Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps: - -1. Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation. -2. Validation: We will validate the issue and work on reproducing it in our environment. -3. Remediation: We will work on a fix and thoroughly test it -4. Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party. -5. Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments. - -This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability. - -## Automatic Scanning -We leverage GitHub Actions to perform automated scans of our supply chain. These scans assist us in identifying vulnerabilities and outdated dependencies in a proactive and timely manner. - -## Credit -We believe in giving credit where credit is due. If you report a security vulnerability to us, and we determine that it is a valid vulnerability, we will publicly credit you for the discovery when we disclose the vulnerability. If you wish to remain anonymous, please indicate so in your initial report. - -We do appreciate and encourage feedback from our community, but currently we do not have a bounty program. We might start bounty programs in the future. - -## Compliance with this Policy -We consider the discovery and reporting of security vulnerabilities an important public service. We encourage responsible reporting of any vulnerabilities that may be found in our site or applications. - -Furthermore, we will not take legal action against or suspend or terminate access to the site or services of those who discover and report security vulnerabilities in accordance with this policy because of the fact. - -We ask that all users and contributors respect this policy and the security of our community's users by disclosing vulnerabilities to us in accordance with this policy. - -## Changes to this Security Policy -This policy may be revised from time to time. Each version of the policy will be identified at the top of the page by its effective date. - -If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com) +If you discover a potential security issue in this project we ask that you notify OpenSearch Security directly via email to security@opensearch.org. Please do **not** create a public GitHub issue. From a56a7e0971a087d3d78908927b0ef7e48bc70947 Mon Sep 17 00:00:00 2001 From: Guido Modarelli Date: Thu, 7 Nov 2024 15:49:01 -0300 Subject: [PATCH 15/15] Revise SECURITY.md to establish Wazuh's formal security policy and guidelines for reporting vulnerabilities --- SECURITY.md | 46 ++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 44 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 9c817530..164723b5 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,45 @@ -# Reporting a Vulnerability +# Wazuh Open Source Project Security Policy -If you discover a potential security issue in this project we ask that you notify OpenSearch Security directly via email to security@opensearch.org. Please do **not** create a public GitHub issue. +Version: 2023-06-12 + +## Introduction +This document outlines the Security Policy for Wazuh's open source projects. It emphasizes our commitment to maintain a secure environment for our users and contributors, and reflects our belief in the power of collaboration to identify and resolve security vulnerabilities. + +## Scope +This policy applies to all open source projects developed, maintained, or hosted by Wazuh. + +## Reporting Security Vulnerabilities +If you believe you've discovered a potential security vulnerability in one of our open source projects, we strongly encourage you to report it to us responsibly. + +Please submit your findings as security advisories under the "Security" tab in the relevant GitHub repository. Alternatively, you may send the details of your findings to [security@wazuh.com](mailto:security@wazuh.com). + +## Vulnerability Disclosure Policy +Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps: + +1. Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation. +2. Validation: We will validate the issue and work on reproducing it in our environment. +3. Remediation: We will work on a fix and thoroughly test it +4. Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party. +5. Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments. + +This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability. + +## Automatic Scanning +We leverage GitHub Actions to perform automated scans of our supply chain. These scans assist us in identifying vulnerabilities and outdated dependencies in a proactive and timely manner. + +## Credit +We believe in giving credit where credit is due. If you report a security vulnerability to us, and we determine that it is a valid vulnerability, we will publicly credit you for the discovery when we disclose the vulnerability. If you wish to remain anonymous, please indicate so in your initial report. + +We do appreciate and encourage feedback from our community, but currently we do not have a bounty program. We might start bounty programs in the future. + +## Compliance with this Policy +We consider the discovery and reporting of security vulnerabilities an important public service. We encourage responsible reporting of any vulnerabilities that may be found in our site or applications. + +Furthermore, we will not take legal action against or suspend or terminate access to the site or services of those who discover and report security vulnerabilities in accordance with this policy because of the fact. + +We ask that all users and contributors respect this policy and the security of our community's users by disclosing vulnerabilities to us in accordance with this policy. + +## Changes to this Security Policy +This policy may be revised from time to time. Each version of the policy will be identified at the top of the page by its effective date. + +If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com)