GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing security.openstack.org — OpenStack Security — OpenStack Security Advisories 0.0.1.dev416 documentation OpenStack Security¶Security is a fundamental goal of the OpenStack architecture and needs to be addressed at all layers of the stack. Like any complex, evolving system security has to be vigilantly pursued, and exposures eliminated. We need your help. OpenStack has two mechanisms for communicating security information with downstream stakeholders, “Advisories” and “Notes”. OpenStack Security Advisories (OSSA) are created to deal with severe security issues in OpenStack for which a fix is available - OSSA’s are issued by the OpenStack Vulnerability Management Team (VMT). OpenStack Security Notes (OSSN) are used for security issues which do not qualify for an advisory, typically design issues, deployment and configuration vulnerabilities. How to report security issues to OpenStack¶For detailed vulnerability reporting instructions, see How to report security issues to OpenStack. Vulnerability Management Team¶See Vulnerability Management Team for the list of OpenStack Vulnerability Managers.
See Vulnerability Management Process for the workflow we follow.
Security information for OpenStack deployers¶There are three main sources of security guidance for OpenStack deployers:
OpenStack Security Advisories (OSSA)¶Security Advisories (OSSA) advise users of major security issues which can be resolved with a code change. Recent OSSAs:
You can find the complete list of published advisories here: OpenStack Security Notes¶Security Notes (OSSN) advise users of security related issues that, for whatever reason, are too complex to be solved with a simple patch. This can include security risks that OpenStack operators need to be advised of, even if they aren’t bugs in OpenStack directly. You can find the complete list of published notes here: OpenStack Security Guide¶The OpenStack Security Guide provides best practice information for OpenStack deployers. This guide was written by a community of security experts from the OpenStack Security Project, based on experience gained while hardening OpenStack deployments. The guide covers topics including compute and storage hardening, rate limiting, compliance, and cryptography; it is the starting point for anyone looking to securely deploy OpenStack. Read the guide online today. Release Artifact Signatures¶Deliverable artifacts for OpenStack releases, primarily Git tags and Python
package files ( Security information for OpenStack developers¶How to propose and review an embargoed security patch¶Note The embargoed (private) development and review process for security patches is different from normal patches in OpenStack. Because the Gerrit review process is public, all private security bugs must have patches proposed to and reviewed in the StoryBoard or Launchpad report comments or attachments. After a patch for the reported Private Security bug has been developed locally, you the patch author need to share that with the bug’s subscribers. This is a simple process, but it is different than the normal public OpenStack development workflow.
Secure development guidelines¶The OpenStack security team have collaboratively developed this set of guidelines and best practices to help avoid common mistakes that lead to security vulnerabilities within the OpenStack platform.
this page last updated: 2026-08-27 16:17:37
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.
|
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |