Repository navigation
Clarify expected use of Keycloak GitHub Security Advisories #48728
sharpedavid
started this conversation in
Feedback
Replies: 1 comment
|
This has been a small issue for myself too, and I've opened issues #33123 and #47744. Unfortunately, it seems like there may be an issue with how GitHub handles CVEs and there may not be a good way for the team to automatically and correctly link the information in Keycloak's security tab. The information is still shown in the release notes, so the team does inform the users about these issues, but as you have pointed out, if the security tab does not contain an exhaustive list of issues, it may do more harm than good as users may not be aware that the information is incomplete. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi Keycloak contributors,
@ahus1 suggested I open a GitHub Discussion for this topic. For context, he wrote:
My question is about how users should interpret this page:
https://github.com/keycloak/keycloak/security/advisories
I had been treating the GitHub Security Advisories page as an authoritative source for Keycloak CVEs, affected versions, and fixed versions. Based on the guidance above, it sounds like that is not currently the best source to use. For now, release notes are recommended, and NVD may be better for structured CVE searching.
That answer is fine for my use case. My only suggestion is to make this clearer somewhere visible, so other users do not make the same mistake.
For example, if GitHub allows it, the Security Advisories page could include a short note such as:
If GitHub does not allow adding a note there, maybe the same clarification could go in the Keycloak security documentation or another page that users are likely to find.
I am not asking the project to publish more advisories or add a heavier process. I only want to avoid users assuming that the GitHub Security Advisories page is complete when it may not be.
Thanks.
All reactions