Security advisories
Every vulnerability we fix in Celum is published as a GitHub Security Advisory, so there is one record with a stable identifier that both people and tools can follow.
What an advisory contains
Each advisory states:
- The affected component and versions
- The version that fixes it
- A severity rating and, where one is assigned, a CVE identifier
- Credit to the reporter, unless they asked for none
Getting notified
Watch the repository on GitHub and choose Custom, then Security alerts, to be told when a new advisory is published.
Upstream components
Vulnerabilities in the open-source projects Celum builds on — Talos, Cluster API, Cilium, KubeVirt, Rook-Ceph and others — are published by those projects. Where one affects Celum, we publish our own advisory pointing to theirs.
To report a new vulnerability, see the vulnerability disclosure policy.