Security - Revision history

RossBurton at 11:05, 18 March 2026

2026-03-18T11:05:21Z

← Older revision		Revision as of 11:05, 18 March 2026
Line 1:		Line 1:
			'''Note that this page is deprecated and content should be moved to https://docs.yoctoproject.org/security-reference/index.html.'''

	Since the Yocto Project is intended to be flexible and meet the needs of many applications, we leave policy-making decisions around security to our end users. Our goal instead is to ship each release with metadata that follows best practices in that we try our best not to release recipe versions which are known to have significant security vulnerabilities. Generally this is done by upgrading recipes to newer versions that are no longer vulnerable to these issues.		Since the Yocto Project is intended to be flexible and meet the needs of many applications, we leave policy-making decisions around security to our end users. Our goal instead is to ship each release with metadata that follows best practices in that we try our best not to release recipe versions which are known to have significant security vulnerabilities. Generally this is done by upgrading recipes to newer versions that are no longer vulnerable to these issues.

RossBurton: /* Some security related links/useful tools */

2024-02-06T15:56:07Z

Some security related links/useful tools

← Older revision		Revision as of 15:56, 6 February 2024
Line 159:		Line 159:
	* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]		* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]
	* [https://docs.yoctoproject.org/dev-manual/securing-images.html Making Images More Secure] (Development Tasks Manual)		* [https://docs.yoctoproject.org/dev-manual/securing-images.html Making Images More Secure] (Development Tasks Manual)
	* [https://github.com/sjvermeu/cvechecker/ Cvechecker]

	== Security Issues Addressed in Yocto Releases ==		== Security Issues Addressed in Yocto Releases ==

RossBurton: /* Some security related links/useful tools */

2024-02-06T15:55:44Z

Some security related links/useful tools

← Older revision		Revision as of 15:55, 6 February 2024
Line 158:		Line 158:
	* [http://www.cvedetails.com CVE details]		* [http://www.cvedetails.com CVE details]
	* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]		* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]
	* [https://docs.yoctoproject.org/dev-manual/~~common~~-~~tasks~~.html~~#making-images-more-secure~~ Making Images More Secure] (Development Tasks Manual)		* [https://docs.yoctoproject.org/dev-manual/securing-images.html Making Images More Secure] (Development Tasks Manual)
	* [https://github.com/sjvermeu/cvechecker/ Cvechecker]		* [https://github.com/sjvermeu/cvechecker/ Cvechecker]

Marta Rybczynska: Add a page on SECURITY.md

2023-10-24T14:10:57Z

Add a page on SECURITY.md

← Older revision		Revision as of 14:10, 24 October 2023
Line 166:		Line 166:
	* [https://wiki.yoctoproject.org/wiki/Synchronization_CVEs Synchronization on the CVE work]		* [https://wiki.yoctoproject.org/wiki/Synchronization_CVEs Synchronization on the CVE work]
	* [https://wiki.yoctoproject.org/wiki/Security_private_reporting Security team and private reporting]		* [https://wiki.yoctoproject.org/wiki/Security_private_reporting Security team and private reporting]
			* [https://wiki.yoctoproject.org/wiki/SECURITY_file SECURITY.md file]
	* [https://wiki.yoctoproject.org/wiki/File:Yocto_Project_Security_-_26_09_2023.pdf Related slides]		* [https://wiki.yoctoproject.org/wiki/File:Yocto_Project_Security_-_26_09_2023.pdf Related slides]

Marta Rybczynska: We have a security team now, update the information about the private mailing list.

2023-10-24T14:09:48Z

We have a security team now, update the information about the private mailing list.

← Older revision		Revision as of 14:09, 24 October 2023
Line 17:		Line 17:
	== Yocto Security Team ==		== Yocto Security Team ==

	Currently the Yocto Project ~~does not~~ have a Security team. We have two methods of communicating to the project.		Currently, the Yocto Project DOES have a Security team. We have two methods of communicating with the project.

	* See the Yocto Project TSC Future Directions [https://wiki.yoctoproject.org/wiki/Future_Directions#Security security]


Line 30:		Line 28:

	* '''Private List'''		* '''Private List'''
	: security [at] yoctoproject [dot] org ~~(Forwards to the following addresses)~~		: security [at] yoctoproject [dot] org
			: For non-public or urgent issues.
	: : - ~~'''mhalstead [at] linuxfoundation [dot] org'''~~
	~~: For secure communications, please send your messages encrypted to both using the following GPG keys.~~
	~~: Remember message headers are not encrypted so do not include sensitive information in the subject line.~~

	~~: Download~~ public ~~keys: [https://pgp.mit~~.~~edu/pks/lookup?op=vindex&search=0x3373170601861969 Michael Halstead]~~

	Anyone can contribute with security patches as before, but those volunteering to this security team will sync/organize security related activities and take more responsibility.		Anyone can contribute with security patches as before, but those volunteering to this security team will sync/organize security related activities and take more responsibility.

Marta Rybczynska: Add slides from Sept 26, 2023

2023-09-29T18:07:46Z

Add slides from Sept 26, 2023

← Older revision		Revision as of 18:07, 29 September 2023
Line 173:		Line 173:
	* [https://wiki.yoctoproject.org/wiki/Synchronization_CVEs Synchronization on the CVE work]		* [https://wiki.yoctoproject.org/wiki/Synchronization_CVEs Synchronization on the CVE work]
	* [https://wiki.yoctoproject.org/wiki/Security_private_reporting Security team and private reporting]		* [https://wiki.yoctoproject.org/wiki/Security_private_reporting Security team and private reporting]
			* [https://wiki.yoctoproject.org/wiki/File:Yocto_Project_Security_-_26_09_2023.pdf Related slides]

Marta Rybczynska: Add Security work in progress (discussions on processes)

2023-09-25T17:38:30Z

Add Security work in progress (discussions on processes)

← Older revision		Revision as of 17:38, 25 September 2023
Line 169:		Line 169:

	== Security Issues Addressed in Yocto Releases ==		== Security Issues Addressed in Yocto Releases ==

			== Current work in progress ==
			* [https://wiki.yoctoproject.org/wiki/Synchronization_CVEs Synchronization on the CVE work]
			* [https://wiki.yoctoproject.org/wiki/Security_private_reporting Security team and private reporting]

Michael Opdenacker: /* Some security related links/useful tools */ Remove obsolete link about kernel 4.14 vulnerabilities

2022-07-26T19:08:08Z

Some security related links/useful tools: Remove obsolete link about kernel 4.14 vulnerabilities

← Older revision		Revision as of 19:08, 26 July 2022
Line 162:		Line 162:
	* [https://wiki.yoctoproject.org/wiki/images/5/58/Yocto_Summit_Lyon_Day1_2019.pdf#page=36 Yocto Project and CVEs, presentation by David Reyna in 2019 Yocto Developer day]		* [https://wiki.yoctoproject.org/wiki/images/5/58/Yocto_Summit_Lyon_Day1_2019.pdf#page=36 Yocto Project and CVEs, presentation by David Reyna in 2019 Yocto Developer day]
	* [https://github.com/nluedtke/linux_kernel_cves/ Linux kernel fixed and reported CVEs in all branches and point releases]		* [https://github.com/nluedtke/linux_kernel_cves/ Linux kernel fixed and reported CVEs in all branches and point releases]
	** ~~for example [https://github.com/nluedtke/linux_kernel_cves/blob/master/data/4.14/4.14_security.txt 4.14.x kernel series CVE status]~~		** Note that cherry-picking CVE fixes for kernel is not recommended and users should merge full stable releases instead, see [http://www.kroah.com/log/blog/2018/08/24/what-stable-kernel-should-i-use/ What Stable Kernel Should I Use? by stable kernel maintainer Greg Kroah-Hartman]
	** note that cherry-picking CVE fixes for kernel is not recommended and users should merge full stable releases instead, see [http://www.kroah.com/log/blog/2018/08/24/what-stable-kernel-should-i-use/ What Stable Kernel Should I Use? by stable kernel maintainer Greg Kroah-Hartman]
	* [http://www.cvedetails.com CVE details]		* [http://www.cvedetails.com CVE details]
	* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]		* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]

Michael Opdenacker: /* Some security related links/useful tools */ Fix link to manual

2022-07-26T19:06:24Z

Some security related links/useful tools: Fix link to manual

← Older revision		Revision as of 19:06, 26 July 2022
Line 166:		Line 166:
	* [http://www.cvedetails.com CVE details]		* [http://www.cvedetails.com CVE details]
	* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]		* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]
	* [~~http~~://~~www~~.yoctoproject.org~~/docs/current~~/dev-manual/~~dev~~-~~manual~~.html#making-images-more-secure Making ~~images more secure~~]		* [https://docs.yoctoproject.org/dev-manual/common-tasks.html#making-images-more-secure Making Images More Secure] (Development Tasks Manual)
	* [https://github.com/sjvermeu/cvechecker/ Cvechecker]		* [https://github.com/sjvermeu/cvechecker/ Cvechecker]

	== Security Issues Addressed in Yocto Releases ==		== Security Issues Addressed in Yocto Releases ==

Michael Opdenacker: /* Some security related links/useful tools */ Remove obsolete link to kernel vulnerabilities in 2014

2022-07-26T19:02:04Z

Some security related links/useful tools: Remove obsolete link to kernel vulnerabilities in 2014

← Older revision		Revision as of 19:02, 26 July 2022
Line 165:		Line 165:
	** note that cherry-picking CVE fixes for kernel is not recommended and users should merge full stable releases instead, see [http://www.kroah.com/log/blog/2018/08/24/what-stable-kernel-should-i-use/ What Stable Kernel Should I Use? by stable kernel maintainer Greg Kroah-Hartman]		** note that cherry-picking CVE fixes for kernel is not recommended and users should merge full stable releases instead, see [http://www.kroah.com/log/blog/2018/08/24/what-stable-kernel-should-i-use/ What Stable Kernel Should I Use? by stable kernel maintainer Greg Kroah-Hartman]
	* [http://www.cvedetails.com CVE details]		* [http://www.cvedetails.com CVE details]
	* [http://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/year-2014/Linux-Linux-Kernel.html CVE list, Linux kernel 2014]
	* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]		* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]
	* [http://www.yoctoproject.org/docs/current/dev-manual/dev-manual.html#making-images-more-secure Making images more secure]		* [http://www.yoctoproject.org/docs/current/dev-manual/dev-manual.html#making-images-more-secure Making images more secure]