Common Vulnerabilities and Exposures (CVEs)
Version 1.0 July 2022
CVEs are publicly known vulnerabilities in software which need to be fixed or mitigated by us in a certain timeframe. General information about CVEs can be found in the internet such as Wikipedia: CVE
Roche helps in running notification email lists for certain types of applications. Additionally, Roche is increasing their support for automated system scans.
We also need to stay on the look-out for less publicly known CVEs in checking our base images and code library dependencies on a regular basis.
Assistance per hosting platform
CVEs in our VMs will be patched by GIS.
Docker images need to be patched by the respective team. Our platforms help in running regular scans for us. Scans by Aqua are run by the Minerva team every 6 months as of 2022. CVEs in the CaaS environment can be found on their overview page.
Tasks for applications and services
Patch activities are the duty of the respective service and project team. It is also in their responsibility to receive and deploy patched vendor products in a timely manner. Details can be found in the Roche Security Patch Management Standard.
Rule of thumb for internal system mean that the fix for a CVE should be deployed within two weeks.
Inspiration for a CVE resolution process can be found in the strategy outlined by the Minerva team.
In the case of Java, plugins such as the OWASP and Maven dependency check can help to flag outdated dependencies when building the software. Outdated dependencies have an increased risk of containing a CVE.