diff --git a/templates/security/docker-images.html b/templates/security/docker-images.html index 38703e3846..23138c5715 100644 --- a/templates/security/docker-images.html +++ b/templates/security/docker-images.html @@ -184,10 +184,9 @@

Is the LTS Docker Image Portfolio
-

+

Read more › -

+
{%- endif -%} {%- if slot == 'list_item_title_4' -%} @@ -197,10 +196,9 @@

Is there a long-term commitment? How long?

ESM Images are security-maintained for the full ten year period of their underlying Ubuntu LTS release. Some applications will have versions on multiple Ubuntu LTS versions. In each case, the image is maintained for the full life of the underlying Ubuntu LTS.

-
-

+

Read more › -

+
{%- endif -%} {%- if slot == 'list_item_title_5' -%} @@ -210,10 +208,9 @@

Can I use these images
-

+

Get in touch › -

+
{%- endif -%} {%- if slot == 'list_item_title_6' -%} diff --git a/templates/security/oval.html b/templates/security/oval.html index 63853e7eb6..9ff8bdcb96 100644 --- a/templates/security/oval.html +++ b/templates/security/oval.html @@ -1,265 +1,225 @@ {% extends "security/base_security.html" %} +{% from "_macros/vf_hero.jinja" import vf_hero %} + {% block title %}Ubuntu Oval | Security{% endblock %} -{% block meta_description %}Parameters and methods for consuming Ubuntu OVAL data. OVAL is used by the Ubuntu Security Team for CVE tracking and management.{% endblock %} +{% block meta_description %} + Parameters and methods for consuming Ubuntu OVAL data. OVAL is used by the Ubuntu Security Team for CVE tracking and management. +{% endblock %} -{% block meta_copydoc %}https://docs.google.com/document/d/1hBG6NIfBIrixIV753fsOiEymmeuFIF-KOhiDkV68PRY/edit{% endblock meta_copydoc %} +{% block meta_copydoc %} + https://docs.google.com/document/d/1hBG6NIfBIrixIV753fsOiEymmeuFIF-KOhiDkV68PRY/edit +{% endblock meta_copydoc %} {% block content %} -
-
-
-

- Ubuntu OVAL data -

+ + {% call(slot) vf_hero( + title_text='Ubuntu OVAL data', + layout='25/75' + ) -%} + {%- if slot == 'description' -%}

Canonical's Security Team produces Ubuntu OVAL, a structured, machine-readable dataset for all supported Ubuntu releases. It can be used to evaluate and manage security risks related to any existing Ubuntu components. It is based on the Open Vulnerability and Assessment Language (OVAL).

-
-
- {{ - image( - url="https://assets.ubuntu.com/v1/eb653b8e-oval_logo.png", - alt="", - width="250", - height="164", - hi_def=True, - loading="auto", - ) | safe + {%- endif -%} + {%- if slot =='signpost_image' -%} + {{ image(url="https://assets.ubuntu.com/v1/97cb005e-oval-logo.png", + alt="Oval logo", + width="858", + height="333", + hi_def=True, + loading="auto", + attrs={"class": "u-hide--small u-hide--medium"}) | safe }} + {%- endif -%} + {%- if slot == 'image' -%} +
+ {{ image(url="https://assets.ubuntu.com/v1/7761320f-hero.png", + alt="", + width="2464", + height="1027", + hi_def=True, + loading="auto", + attrs={"class": "p-image-container__image"}) | safe + }} +
+ {% endif -%} + {% endcall -%} + +
+
+
+
+

How we use Ubuntu OVAL

+
+
+

+ Ubuntu OVAL uses the OVAL vulnerability and patch definitions to enable auditing for Common Vulnerabilities and Exposures (CVEs) and to determine whether a particular patch, via an Ubuntu Security Notice (USN), is appropriate for the local system. +

+

+ Ubuntu OVAL also allows for any third-party Security Content Automation Protocol (SCAP) compliant tools to accurately scan an Ubuntu system or an official Ubuntu cloud image for vulnerabilities. +

+
+ See the Ubuntu Security Notices +
+
-
-
+ -
-
-
-

- How we use Ubuntu OVAL -

-

- Ubuntu OVAL uses the OVAL vulnerability and patch definitions to enable auditing for Common Vulnerabilities and Exposures (CVEs) and to determine whether a particular patch, via an Ubuntu Security Notice (USN), is appropriate for the local system. -

-

- Ubuntu OVAL also allows for any third-party Security Content Automation Protocol (SCAP) compliant tools to accurately scan an Ubuntu system or an official Ubuntu cloud image for vulnerabilities. -

- See the Ubuntu Security Notices +
+
+
+
+

Using Ubuntu's OVAL data

+
-
- {{ - image( - url="https://assets.ubuntu.com/v1/f880a3bd-Enterprise+support.svg", - alt="", - width="200", - height="200", - hi_def=True, - loading="lazy", - ) | safe - }} +
+
+
+
-
-
- -
-
-

- Using Ubuntu's OVAL data -

-
-
-
-
    -
  1. -

    - Using OpenSCAP -

    -
    -

    - Download the compressed XML: -

    +
      +
    1. +
      +
      +

      Using OpenSCAP

      +
      +
      +

      Download the compressed XML:

      wget https://security-metadata.canonical.com/oval/com.ubuntu.$(lsb_release -cs).usn.oval.xml.bz2
      -

      - Uncompress the data: -

      +
      +

      Uncompress the data:

      bunzip2 com.ubuntu.$(lsb_release -cs).usn.oval.xml.bz2
      -

      - Use OpenSCAP to evaluate the OVAL and generate an html report: -

      +
      +

      Use OpenSCAP to evaluate the OVAL and generate an html report:

      oscap oval eval --report report.html com.ubuntu.$(lsb_release -cs).usn.oval.xml
      +

      - The output is generated in the file report.html, open it using your browser: + The output is generated in the file report.html, open it using your browser: 

      xdg-open report.html
      -

      - File naming convention: -

      +
      +

      File naming convention:

      com.ubuntu.<example release name>.usn.oval.xml.bz2
      -
      -
      2. -
    2. -

      - Scanning an Official Cloud Image -

      -
      -

      - To scan an Ubuntu Official Cloud Image for known vulnerabilities, the manifest file and xml data can be used together. Unlike above where we were able to use the lsb_release command, you will need to manually enter the URL for the OVAL data. -

      -

      - Note: In the example below we are using focal/20.04, you would replace 'focal' with the version you are inspecting. -

      - 
      wget https://security-metadata.canonical.com/oval/oci.com.ubuntu.focal.usn.oval.xml.bz2
-bunzip2 oci.com.ubuntu.focal.usn.oval.xml.bz2
      -

      - Download the manifest file for the image -

      - 
      wget -O manifest https://cloud-images.ubuntu.com/releases/focal/release/ubuntu-20.04-server-cloudimg-amd64-root.manifest
      -

      - Use OpenSCAP to evaluate the OVAL and generate an html report -

      - 
      oscap oval eval --report report.html oci.com.ubuntu.focal.usn.oval.xml
      -

      - The output is generated in the file report.html, open it using your browser -

      - 
      xdg-open report.html
      -

      - File naming convention: -

      - 
      oci.com.ubuntu.<example release name>.usn.oval.xml.bz2
      -
      -
      3. -
    +
-
- {{ - image( - url="https://assets.ubuntu.com/v1/2670bd16-OpenScap-logo.svg", - alt="", - width="210", - height="46", - hi_def=True, - loading="lazy", - ) | safe - }} + +
  • +
    +
    +
    +
    -
    • -
    - -
    -
    -
    -

    - Ubuntu OVAL data parameters -

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - Parameter - - Description -
    - CVE_ID - - CVE number as reported by MITRE -
    - USN - - Corresponding Ubuntu Security Notice -
    - Description - - A short description of the security risk addressed -
    - Severity - - CVE or USN severity as defined by the Ubuntu Security team -
    - Affected Platform - - Affected Ubuntu release(s), incl ESM -
    - Title - - CVE number, affected Ubuntu release(s), and Severity -
    - Public date - - The date on which a CVE was publicly announced -
    - Public date of USN - - The date on which a USN was published -
    - Reference - - Links to more information about the issue -
    - BugReport - - Link to bugreport about the issue -
    -

    - - Note: The above parameters are included in the OVAL xml file, but not all are shown in the resulting generated OpenSCAP report. - -

    +
    +
    +

    Scanning an
    Official Cloud Image

    +
    +
    +

    + To scan an Ubuntu Official Cloud Image for known vulnerabilities, the manifest file and xml data can be used together. Unlike above where we were able to use the lsb_release command, you will need to manually enter the URL for the OVAL data. +

    +

    In the example below we are using focal/20.04, you would replace 'focal' with the version you are inspecting.

    + 
    wget https://security-metadata.canonical.com/oval/oci.com.ubuntu.focal.usn.oval.xml.bz2
    bunzip2 oci.com.ubuntu.focal.usn.oval.xml.bz2
    +
    +

    Download the manifest file for the image

    + 
    wget -O manifest https://cloud-images.ubuntu.com/releases/focal/release/ubuntu-20.04-server-cloudimg-amd64-root.manifest
    +
    +

    Use OpenSCAP to evaluate the OVAL and generate an html report

    + 
    oscap oval eval --report report.html oci.com.ubuntu.focal.usn.oval.xml
    +
    +

    + The output is generated in the file report.html, open it using your browser +

    + 
    xdg-open report.html
    +
    +

    File naming convention:

    + 
    oci.com.ubuntu.<example release name>.usn.oval.xml.bz2
    +
    + + +
    + +
    +
    +
    +
    +

    Ubuntu OVAL data parameters

    +
    +
    +
    +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ParameterDescription
    CVE_IDCVE number as reported by MITRE
    USNCorresponding Ubuntu Security Notice
    DescriptionA short description of the security risk addressed
    SeverityCVE or USN severity as defined by the Ubuntu Security team
    Affected PlatformAffected Ubuntu release(s), incl ESM
    TitleCVE number, affected Ubuntu release(s), and Severity
    Public dateThe date on which a CVE was publicly announced
    Public date of USNThe date on which a USN was published
    ReferenceLinks to more information about the issue
    BugReportLink to bugreport about the issue
    + + Note: The above parameters are included in the OVAL xml file, but not all are shown in the resulting generated OpenSCAP report. + +
    -
    +
    +
    -
    -
    -
    -

    - How Ubuntu OVAL data works -

    +
    +
    +
    +
    +
    +

    How Ubuntu OVAL data works

    +
    +

    As software vulnerabilities are discovered, they are assigned CVE identifiers by MITRE and other organizations. Canonical triages these CVEs to determine whether the vulnerabilities affect software distributed within Ubuntu. The results of this triage are then used to generate the CVE OVAL. The CVE OVAL can be used to assess the local system for vulnerabilities.

    @@ -268,19 +228,19 @@

    -
    - {{ - image( - url="https://assets.ubuntu.com/v1/ce2c3422-how-OVAL-data-works-diagram.svg", - alt="", - width="682", - height="290", - hi_def=True, - loading="lazy", - - ) | safe +
    +
    +
    + {{ image(url="https://assets.ubuntu.com/v1/4745474d-how-ubuntu-oval.png", + alt="", + width="3696", + height="1541", + hi_def=True, + loading="lazy", + attrs={"class": "p-image-container__image"}) | safe }}
    -
    +
    +
    - {% endblock content %} +{% endblock content %}