From 66524a71c33c7c3769a1905fbbbd0b4eaa9c1c87 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Fri, 13 Sep 2024 13:23:04 +0200 Subject: [PATCH 1/5] Updated SECURITY.md file --- SECURITY.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 54e59de1f..86f56db85 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -16,11 +16,15 @@ Please submit your findings as security advisories under the "Security" tab in t ## Vulnerability Disclosure Policy Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps: -- Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation. -- Validation: We will validate the issue and work on reproducing it in our environment. -- Remediation: We will work on a fix and thoroughly test it -- Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party. -- Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments. +1. Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation. + +2. Validation: We will validate the issue and work on reproducing it in our environment. + +3. Remediation: We will work on a fix and thoroughly test it. + +4. Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party. + +5. Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments. This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability. @@ -33,7 +37,7 @@ We believe in giving credit where credit is due. If you report a security vulner We do appreciate and encourage feedback from our community, but currently we do not have a bounty program. We might start bounty programs in the future. ## Compliance with this Policy -We consider the discovery and reporting of security vulnerabilities an important public service. We encourage responsible reporting of any vulnerabilities that may be found in our site or applications. +We consider the discovery and reporting of security vulnerabilities an important public service. We encourage responsible reporting of any vulnerabilities that may be found in our site or applications. Furthermore, we will not take legal action against or suspend or terminate access to the site or services of those who discover and report security vulnerabilities in accordance with this policy because of the fact. From 6fb5192ed962a72fc4f18480358a6fde1d2a7b2b Mon Sep 17 00:00:00 2001 From: "JESUS D. GARCIA" Date: Fri, 13 Sep 2024 09:27:26 -0500 Subject: [PATCH 2/5] Add support for journald logs --- .../templates/var-ossec-etc-ossec-agent.conf.j2 | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 index b1a282493..99fd93f93 100644 --- a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 +++ b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 @@ -284,7 +284,7 @@ {% endif %} - {% if wazuh_agent_config.syscheck.ignore is defined and (ansible_system == "Linux" or ansible_system == "Darwin") %} + {% if wazuh_agent_config.syscheck.ignore is defined and (ansible_system == "Linux" or ansible_system == "Darwin") %} {% for ignore in wazuh_agent_config.syscheck.ignore %} {{ ignore }} {% endfor %} @@ -378,6 +378,10 @@ {% endif %} {% endfor %} + + journald + journald + {% endif %} {% if ansible_system == "Darwin" %} From 20f7a3af378f62fb48f219b4d642e68b735c3198 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Mon, 16 Sep 2024 15:27:16 -0300 Subject: [PATCH 3/5] Changed SECURITY.md file --- SECURITY.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 86f56db85..4d35ef4f3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -17,13 +17,9 @@ Please submit your findings as security advisories under the "Security" tab in t Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps: 1. Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation. - 2. Validation: We will validate the issue and work on reproducing it in our environment. - -3. Remediation: We will work on a fix and thoroughly test it. - +3. Remediation: We will work on a fix and thoroughly test it 4. Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party. - 5. Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments. This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability. @@ -46,4 +42,4 @@ We ask that all users and contributors respect this policy and the security of o ## Changes to this Security Policy This policy may be revised from time to time. Each version of the policy will be identified at the top of the page by its effective date. -If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com). +If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com) From 3a576c838adeb5ec043f208000a3665a7a7389c6 Mon Sep 17 00:00:00 2001 From: "JESUS D. GARCIA" Date: Thu, 19 Sep 2024 09:21:40 -0500 Subject: [PATCH 4/5] Add until to security_actions.yml --- roles/wazuh/wazuh-indexer/tasks/security_actions.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/wazuh/wazuh-indexer/tasks/security_actions.yml b/roles/wazuh/wazuh-indexer/tasks/security_actions.yml index 8d4f8797d..f87a3f755 100644 --- a/roles/wazuh/wazuh-indexer/tasks/security_actions.yml +++ b/roles/wazuh/wazuh-indexer/tasks/security_actions.yml @@ -112,8 +112,8 @@ status_code: 200,201,401 return_content: yes timeout: 4 + register: result + until: result.status in [200,201,401] when: - indexer_custom_user is defined and indexer_custom_user - inventory_hostname == ansible_play_hosts[0] - - From 61f270738ad3f60897f1669aa807f4d43db5f554 Mon Sep 17 00:00:00 2001 From: Enrique Araque Date: Fri, 20 Sep 2024 12:36:03 +0200 Subject: [PATCH 5/5] Bump revision to 40911 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index a5a980b9d..21a80396e 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-ANSIBLE_VERSION="v4.9.1" -REVISION="40910" +REVISION="40911"