Security

SECURITY.md

EdgeX Security Policy

Supported Versions

Not every EdgeX release receives security support. Please consult the EdgeX Foundry Wiki for information on the EdgeX Long Term Support Policy.

Reporting Vulnerabilities

Instructions to report a vulnerability may be found on the security page of the EdgeX Foundry Wiki.

Questions

Questions on the EdgeX security policy can be raised in the EdgeX Security Working Group or to the EdgeX Technical Steering Committee.

Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users
GHSA-g63h-q855-vp3q published Jun 14, 2022 by MightyNerdEric

Moderate
Weak password in API gateway in EdgeX Foundry Edinburgh, Fuji, Geneva, and Hanoi releases allows remote attackers to obtain authentication token via dictionary-based password attack when OAuth2 authentication method is enabled.
GHSA-xph4-vmcc-52gh published Jul 9, 2021 by MightyNerdEric

High

Learn more about advisories related to edgexfoundry/edgex-go in the GitHub Advisory Database