From 95e83ad9bd4fd729678ccc98d7497b452edc04f1 Mon Sep 17 00:00:00 2001
From: Martin Kuba <martin@martinkuba.com>
Date: Sun, 10 Dec 2023 10:56:32 -0800
Subject: [PATCH] Add CVE page (#3659)

Co-authored-by: Severin Neumann <severin.neumann@altmuehlnet.de>
Co-authored-by: Phillip Carter <pcarter@fastmail.com>
---
 content/en/docs/security/_index.md |  4 ++
 content/en/docs/security/cve.md    | 74 ++++++++++++++++++++++++++++++
 static/refcache.json               |  8 ++++
 3 files changed, 86 insertions(+)
 create mode 100644 content/en/docs/security/_index.md
 create mode 100644 content/en/docs/security/cve.md

diff --git a/content/en/docs/security/_index.md b/content/en/docs/security/_index.md
new file mode 100644
index 000000000000..27d2cfac5544
--- /dev/null
+++ b/content/en/docs/security/_index.md
@@ -0,0 +1,4 @@
+---
+title: Security
+weight: 150
+---
diff --git a/content/en/docs/security/cve.md b/content/en/docs/security/cve.md
new file mode 100644
index 000000000000..3c6b8fb18730
--- /dev/null
+++ b/content/en/docs/security/cve.md
@@ -0,0 +1,74 @@
+---
+title: Common Vulnerabilities and Exposures
+weight: 102
+---
+
+This is a list of reported Common Vulnerabilities and Exposures (CVEs) across
+all repositories in the
+[OpenTelemetry organization on GitHub](https://github.com/open-telemetry/). The
+raw data is stored in the
+[sig-security](https://github.com/open-telemetry/sig-security) repository, and
+it is refreshed daily.
+
+<table id="cve-table">
+  <thead>
+    <tr>
+      <th>CVE ID</th>
+      <th>Issue Summary</th>
+      <th>Severity</th>
+      <th>Repository</th>
+    </tr>
+  </thead>
+  <tbody>
+  </tbody>
+</table>
+
+<script id="main-script">
+  'use strict';
+  (function() {
+    function fetchAndRender() {
+      fetchData()
+        .then(renderTable);
+    }
+
+    function fetchData() {
+      var url = 'https://raw.githubusercontent.com/open-telemetry/sig-security/data-source/published_output.json';
+      return fetch(url)
+        .then(function(response) {
+          return response.json();
+        });
+    }
+
+    function renderTable(data) {
+      var table = document.getElementById('cve-table').querySelector('tbody');
+
+      data.sort((a, b) => new Date(b.created_at) - new Date(a.created_at));
+
+      data.forEach(item => {
+        var row = table.insertRow();
+
+        const cell1 = row.insertCell(0);
+        const link = document.createElement('a');
+        link.href = item['html_url'];
+        link.target = '_blank';
+        link.textContent = item['cve_id'];
+        cell1.appendChild(link);
+
+        const cell2 = row.insertCell(1);
+        cell2.textContent = item['summary'];
+        const cell3 = row.insertCell(2);
+        cell3.textContent = item['severity'];
+
+        const cell4 = row.insertCell(3);
+        // cell4.textContent = item['repo'];
+        const link2 = document.createElement('a');
+        link2.href = 'https://www.github.com/open-telemetry/' + item['repo'] + '/security/advisories';
+        link2.target = '_blank';
+        link2.textContent = item['repo'];
+        cell4.appendChild(link2);
+      });
+    }
+
+    fetchAndRender();
+  })();
+</script>
diff --git a/static/refcache.json b/static/refcache.json
index 80a2b3fd695d..1fe39ea2a263 100644
--- a/static/refcache.json
+++ b/static/refcache.json
@@ -2551,6 +2551,10 @@
     "StatusCode": 200,
     "LastSeen": "2023-06-30T08:31:22.656334-04:00"
   },
+  "https://github.com/open-telemetry/": {
+    "StatusCode": 200,
+    "LastSeen": "2023-12-08T15:19:55.887939-08:00"
+  },
   "https://github.com/open-telemetry/community": {
     "StatusCode": 200,
     "LastSeen": "2023-06-30T09:28:03.502113-04:00"
@@ -3723,6 +3727,10 @@
     "StatusCode": 200,
     "LastSeen": "2023-11-03T20:22:42.689401141Z"
   },
+  "https://github.com/open-telemetry/sig-security": {
+    "StatusCode": 200,
+    "LastSeen": "2023-12-07T16:14:09.891942-08:00"
+  },
   "https://github.com/opentracing": {
     "StatusCode": 200,
     "LastSeen": "2023-06-30T08:40:39.909083-04:00"