| 1 | ELIOT SD-WAN/WAN Edge/uCPE Blueprint | The following exceptions must be fixed prior to maturity review: - CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods. If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.
| 2 | Enterprise Applications on Lightweight 5G Telco Edge | The following exceptions must be fixed prior to maturity review: - CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods. If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.
| 3 | Public Cloud Edge Interface (PCEI) Blueprint | The following exceptions must be fixed prior to maturity review: - test ID AUTH-9328 (Default umask values)
Reason: <Oleg Berzin> Cannot fix AUTH-9328 because changing unmask value to 027 caused lynis test suite to fail (does not run) | The following exceptions must be fixed prior to maturity review: - CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods. If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.
| 4 | The AI Edge: Federated ML application at edge | Release 5: Akraino CVE Vulnerability Exception Request | 5 | KNI Provider Access Edge | The following exceptions must be fixed prior to maturity review: - CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods. If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.
| 6 | KNI Industrial Edge | The following exceptions must be fixed prior to maturity review: - CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods. If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.
| 7 | IEC Type 2 | Smart Data Transaction for CPS | See results here Logs: https://nexus.akraino.org/content/sites/logs/fujitsu/job/sdt-vuls/2/ Exceptions requested for the following: CVE-2016-1585
CVE-2021-20236
CVE-2021-31870
CVE-2021-31872
CVE-2021-31873
CVE-2021-33574
CVE-2021-45951
CVE-2021-45952
CVE-2021-45953
CVE-2021-45954
CVE-2021-45955
CVE-2021-45956
CVE-2021-45957
CVE-2022-23218
CVE-2022-23219
CVE-2016-9180
CVE-2021-35942 Exception Requests | Passing incubation criteria See results here Logs: https://nexus.akraino.org/content/sites/logs/fujitsu/job/sdt-lynis/2/ | Pass *1 Test case failure due to suspected tool issue See results here Logs: https://nexus.akraino.org/content/sites/logs/fujitsu/job/sdt-bluval/2/ |
| 3 | IEC Type 5: SmartNIC for Integrated Edge Cloud (IEC) Blueprint Family | Information Disclosure: Exposed pods. An attacker could view sensitive information about pods that are bound to a Node using the /pods endpoint.KHV043 (Information Disclosure): Cluster Health Disclosure. By accessing the open /healthz handler, an attacker could get the cluster health state without authenticating.KHV044 (Access Risk): Pivileged Container. A privileged container exists on a node, could expose the node /cluster to unwanted root operations.See results here | the security issues observed seem to be specific to microk8s cluster. We ran the sonobuoy tests & kube-hunter against k3s and there are no issues in the master setup. We are working with Canonical to review our configuration.
The following exceptions must be fixed prior to maturity review:
Exceptions requested for the following: CVE-2021-43527
CVE-2014-9939
CVE-2015-4042
CVE-2022-22822
CVE-2022-22823
CVE-2022-22824
CVE-2022-23852
CVE-2022-25235
CVE-2022-25236
CVE-2022-25315 | See results here Exceptions requested for the following: - BOOT-5122: GRUB boot password interferes with the unattended reboot during OS provisioning.
- USB-2000: USB hubs and HID device must be enabled for BMC Console Redirection.
- Performing test ID HRDN-7220 already exists
 Image Added
| See results here We are not using Kubernets, so we do not need to do a Kube-Hunter scan. |