Standards

Appearance

Handling critical security vulnerabilities ​

Unaddressed vulnerabilities can be exploited for remote code execution or full server compromise, so critical-level vulnerabilities in Composer dependencies must be addressed promptly.

Process ​

  1. Agencybeam DevOps continually monitors each site for critical-level Composer vulnerabilities. If any are found, it raises a ticket on the Jira support board for the affected site. Where a project has multiple environments deployed (e.g. production and staging), a separate ticket is raised for each environment.
  2. The ticket is assigned to a developer via Jira's developer field, which triggers the standard approval process. If the same issue affects multiple environments, all related tickets should be assigned to the same developer to avoid duplicated effort.
  3. The ticket lists the affected packages. Run composer update -Wm, then composer audit to confirm no critical-level issues remain. See Maintenance for more information on Composer commands.
  4. If the vulnerability can't be resolved with a minor update, update the ticket to note that a major upgrade is required (e.g. due to a major version bump or version conflict). This pauses the process until further information or approval is provided.
  5. Deploy the change as appropriate for the project's workflow (see Basic workflow and Quality-assured workflow), subject to the deployment cutoff below.
  6. Load the site in a browser and check for any obvious errors.
  7. Comment on the ticket, mentioning @Support Team, to confirm the affected packages have been updated and deployed.
  8. Once resolved, Agencybeam DevOps will comment confirming the fix, and the ticket can be closed.

TIP

This process should typically take no more than 10 minutes per ticket. However, the update may not always be straightforward, e.g. due to dependency conflicts or divergence between environments. If you are at all uncertain about how to proceed, speak to a senior developer rather than deferring the ticket.

Deployment cutoff ​

Addressing a critical vulnerability does not override the standard deployment cutoff: never deploy after 3pm, and never on a Friday.

Time logging ​

Unless advised otherwise, time is always logged against MSINT-308.