Pivotal Platform Security Overview and Policy

Page last updated:

This document outlines Pivotal’s security policy and is addressed to operators deploying Pivotal Platform using Pivotal Operations Manager.

For a comprehensive overview of the security architecture of each Pivotal Application Service (PAS) component, see PAS Security.

How Pivotal Monitors for Security Vulnerabilities

Pivotal receives private reports on vulnerabilities from customers and from field personnel through Pivotal’s secure disclosure process. Pivotal also monitors public repositories of software security vulnerabilities to identify newly discovered vulnerabilities that might affect one or more of Pivotal’s products.

How to Report a Vulnerability

Pivotal encourages users who become aware of a security vulnerability in Pivotal’s products to contact Pivotal with details of the vulnerability. Please send descriptions of any vulnerabilities found to security@pivotal.io. Include details about the software and hardware configuration of your system so that Pivotal can reproduce the issue.

Note: Pivotal encourages use of encrypted email. For Pivotal’s public PGP key, see Pivotal Application Security Team on the Pivotal website.

Notification Policy

Pivotal Platform has many customer stakeholders who need to know about security updates. When there is a possible security vulnerability identified for a Pivotal Platform component, Pivotal does the following:

  1. Assess the impact to Pivotal Platform.

  2. If the vulnerability would affect a Pivotal Platform component, Pivotal schedules an update for the impacted components.

  3. Update the affected components and perform system tests.

  4. Announce the fix publicly through the following channels:

    1. Automated notification to end users who have downloaded or subscribed to a Pivotal Platform product on Pivotal Network when a new, fixed version is available.
    2. Adding a new post to the Pivotal Application Security Team page.

Classes of Vulnerabilities

For vulnerabilities related to Ubuntu provided packages, Pivotal follows Canonical’s priority levels. For other vulnerabilities, Pivotal follows Common Vulnerability Scoring System v3.0 standards when assessing severity. For more information about Canonical’s priority levels, see CVE Priority in Ubuntu CVE Tracker. For more information about Common Vulnerability Scoring System v3.0 standards, see Common Vulnerability Scoring System version 3.1: Specification Document on the FIRST website.

Pivotal uses Canonical’s Ubuntu distribution of Linux for Pivotal Platform Ubuntu stemcells and rootfs. Canonical provides Pivotal with support services allowing Pivotal to escalate CVEs that Pivotal determine might affect Pivotal Platform. In general, Pivotal does not escalate to upstream open source software components or vendors for Medium or Low CVEs that are not yet patched. Pivotal Platform can escalate on behalf of a customer for High or Critical CVEs. Pivotal Platform customers who are interested in addressing CVEs in Ubuntu that are not yet patched can establish their own support relationship with Canonical through the Support page on the Ubuntu website.

Pivotal reports the severity of vulnerabilities using the following severity classes:

High

High severity vulnerabilities are those that can be exploited by an unauthenticated or authenticated attacker, from the Internet or those that break the guest/host Operating System isolation. The exploitation could result in the complete compromise of confidentiality, integrity, and availability of user data and/or processing resources without user interaction. Exploitation could be leveraged to propagate an Internet worm or execute arbitrary code between Virtual Machines (VMs) and/or the Host Operating System. This rating also applies to those vulnerabilities that could lead to the complete compromise of availability when the exploitation is by a remote unauthenticated attacker from the Internet or through a breach of VM isolation.

Medium

Medium vulnerabilities are those in which the ability to exploit is mitigated to a significant degree by configuration or difficulty of exploitation, but in certain deployment scenarios could still lead to the compromise of confidentiality, integrity, or availability of user data and/or processing resources.

Low

Low vulnerabilities are all other issues that have a security impact. These include vulnerabilities for which exploitation is believed to be extremely difficult, or for which successful exploitation would have minimal impact.

Release Policy

Pivotal Platform schedules regular monthly releases of software in the Pivotal Platform suite to address Low and Medium severity vulnerability exploits. When High severity vulnerability exploits are identified, Pivotal Platform releases fixes to software in the Pivotal Platform suite on-demand, with as fast a turnaround as possible.

Alerts and Actions Archive

To review an archive of Pivotal Platform vulnerability reports, see the Pivotal Product Vulnerability Reports on the Pivotal Application Security Team page.