Skip to content

Commit ea44717

Browse files
josecelanojosecelano
committed
docs: add security issue review specs for #429, #431-#435, #443, #444 
1 parent 844c78e commit ea44717

9 files changed

Lines changed: 459 additions & 0 deletions

‎docs/issues/429-deployer-cves.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Issue #429: Deployer Image CVEs after Remediation Pass 1
2+
3+
**GitHub**: <https://github.com/torrust/torrust-tracker-deployer/issues/429>
4+
**Image**: `torrust/tracker-deployer:local`
5+
**Dockerfile**: `docker/deployer/Dockerfile`
6+
7+
---
8+
9+
## Context
10+
11+
After PR #436 removed `gnupg` from the runtime layer:
12+
13+
| Pass | HIGH | CRITICAL |
14+
| ------------------ | ---- | -------- |
15+
| Before remediation | 49 | 1 |
16+
| After pass 1 | 44 | 1 |
17+
18+
Remaining findings split into two areas:
19+
20+
1. **Debian 13.4 (trixie) base packages** — HIGH, blocked on upstream patches
21+
2. **OpenTofu binary** — 2 HIGH + 1 CRITICAL, blocked on OpenTofu release
22+
23+
## Decision
24+
25+
**Re-scan and check OpenTofu release, then decide**:
26+
27+
- If a newer OpenTofu release clears the CRITICAL: update the pinned version,
28+
rebuild, re-scan, update scan doc, close #429
29+
- If Debian packages are now patched: `docker build --no-cache` will pick them up;
30+
re-scan, update scan doc, re-evaluate #429
31+
- If nothing has changed: post comment documenting current state and accepted risk;
32+
leave open with revisit note
33+
34+
## Steps
35+
36+
- [ ] Check current OpenTofu version pinned in the Dockerfile:
37+
`grep -i opentofu docker/deployer/Dockerfile`
38+
- [ ] Check latest OpenTofu release:
39+
<https://github.com/opentofu/opentofu/releases>
40+
- [ ] Rebuild and re-scan:
41+
42+
```bash
43+
docker build --no-cache -t torrust/tracker-deployer:local docker/deployer/
44+
trivy image --severity HIGH,CRITICAL torrust/tracker-deployer:local
45+
```
46+
47+
- [ ] Compare against the pass-1 baseline in
48+
`docs/security/docker/scans/torrust-tracker-deployer.md`
49+
- [ ] For Debian base package CVEs, check fix availability:
50+
<https://security-tracker.debian.org/tracker/>
51+
- [ ] Update `docs/security/docker/scans/torrust-tracker-deployer.md` with new
52+
scan results
53+
- [ ] **If CRITICAL is cleared**: update Dockerfile OpenTofu version; post results
54+
comment; close #429
55+
- [ ] **If only Debian packages improved**: post results comment; re-evaluate open
56+
status
57+
- [ ] **If no change**: post comment with accepted risk rationale for remaining
58+
CVEs; label `accepted-risk`; leave open with revisit note
59+
60+
## Outcome
61+
62+
<!-- Fill in after doing the work -->
63+
64+
- Date:
65+
- Current OpenTofu version in Dockerfile:
66+
- Latest OpenTofu release:
67+
- Findings after rebuild (HIGH / CRITICAL):
68+
- Decision: fixed / partial / accepted risk
69+
- Comment/PR:

‎docs/issues/431-backup-cves.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Issue #431: Backup Image CVEs after Remediation Pass 1
2+
3+
**GitHub**: <https://github.com/torrust/torrust-tracker-deployer/issues/431>
4+
**Image**: `torrust/tracker-backup:local`
5+
**Dockerfile**: `docker/backup/Dockerfile`
6+
7+
---
8+
9+
## Context
10+
11+
After PR #436 added `apt-get upgrade -y` to the base layer, findings did not change
12+
(upstream Debian packages were not patched at the time):
13+
14+
| Pass | HIGH | CRITICAL |
15+
| ------------------ | ---- | -------- |
16+
| Before remediation | 6 | 0 |
17+
| After pass 1 | 6 | 0 |
18+
19+
All 6 HIGH are Debian 13.4 (trixie) base package CVEs.
20+
21+
## Decision
22+
23+
**Rebuild and re-scan to check if Debian packages are now patched, then decide**:
24+
25+
- If package fixes are now available: `docker build --no-cache` will pick them up
26+
automatically via `apt-get upgrade -y`; verify and close #431
27+
- If still unpatched: post comment with current scan confirming same count, document
28+
accepted risk, close #431
29+
30+
## Steps
31+
32+
- [ ] Rebuild the image from scratch:
33+
`docker build --no-cache -t torrust/tracker-backup:local docker/backup/`
34+
- [ ] Re-scan: `trivy image --severity HIGH,CRITICAL torrust/tracker-backup:local`
35+
- [ ] Compare against the pass-1 baseline in
36+
`docs/security/docker/scans/torrust-tracker-backup.md`
37+
- [ ] For each remaining CVE, check fix availability:
38+
<https://security-tracker.debian.org/tracker/>
39+
- [ ] Update `docs/security/docker/scans/torrust-tracker-backup.md` with the new
40+
scan results
41+
- [ ] **If HIGH count dropped**: post comment with before/after results; close #431
42+
- [ ] **If no change**: post comment documenting that Debian upstream has not yet
43+
patched these CVEs with a revisit note; close #431
44+
45+
## Outcome
46+
47+
<!-- Fill in after doing the work -->
48+
49+
- Date:
50+
- Findings after rebuild (HIGH / CRITICAL):
51+
- Debian packages patched: yes / no
52+
- Decision: resolved / accepted risk
53+
- Comment/PR:

‎docs/issues/432-caddy-cves.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Issue #432: Caddy CVEs after upgrade to 2.10.2
2+
3+
**GitHub**: <https://github.com/torrust/torrust-tracker-deployer/issues/432>
4+
**Image**: `caddy:2.10.2`
5+
**Template**: `templates/docker-compose/docker-compose.yml.tera`
6+
7+
---
8+
9+
## Context
10+
11+
After PR #436 upgraded Caddy from `2.10` to `2.10.2`:
12+
13+
| Version | HIGH | CRITICAL |
14+
| -------- | ---- | -------- |
15+
| `2.10` | 18 | 6 |
16+
| `2.10.2` | 14 | 4 |
17+
18+
4 CRITICAL remain in upstream Caddy binary dependencies.
19+
20+
## Decision
21+
22+
**Re-scan with latest Caddy tag, then decide**:
23+
24+
- If a newer tag clears CRITICALs: upgrade, update scan doc, close #432
25+
- If not: post comment with scan results, document accepted risk, leave open with
26+
revisit note
27+
28+
## Steps
29+
30+
- [ ] Check the latest Caddy release:
31+
<https://hub.docker.com/_/caddy> and <https://github.com/caddyserver/caddy/releases>
32+
- [ ] Run Trivy against the latest tag:
33+
`trivy image --severity HIGH,CRITICAL caddy:LATEST_TAG`
34+
- [ ] Compare results against the 2.10.2 baseline in
35+
`docs/security/docker/scans/caddy.md`
36+
- [ ] **If CRITICALs are cleared (or HIGH count drops meaningfully)**: update
37+
`templates/docker-compose/docker-compose.yml.tera` and the CI scan matrix;
38+
update the scan doc; post results comment; close #432
39+
- [ ] **If CRITICALs remain**: post comment documenting which CVEs remain and why
40+
they cannot be fixed (upstream binary); add revisit note to #432; leave open
41+
42+
## Outcome
43+
44+
<!-- Fill in after doing the work -->
45+
46+
- Date:
47+
- Latest Caddy tag tested:
48+
- Findings (HIGH / CRITICAL):
49+
- Decision: upgrade / accept risk / leave open
50+
- Comment/PR:

‎docs/issues/433-prometheus-cves.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Issue #433: Prometheus CVEs after upgrade to v3.5.1
2+
3+
**GitHub**: <https://github.com/torrust/torrust-tracker-deployer/issues/433>
4+
**Image**: `prom/prometheus:v3.5.1`
5+
**Default set in**: `src/domain/prometheus/config.rs`
6+
7+
---
8+
9+
## Context
10+
11+
After PR #436 upgraded Prometheus from `v3.5.0` to `v3.5.1`:
12+
13+
| Version | HIGH | CRITICAL |
14+
| -------- | ---- | -------- |
15+
| `v3.5.0` | 16 | 4 |
16+
| `v3.5.1` | 6 | 4 |
17+
18+
4 CRITICAL remain in upstream binary dependencies.
19+
20+
## Decision
21+
22+
**Re-scan with latest Prometheus tag, then decide**:
23+
24+
- If a newer tag clears CRITICALs: upgrade, update scan doc, close #433
25+
- If not: post comment with scan results, document accepted risk, leave open with
26+
revisit note
27+
28+
## Steps
29+
30+
- [ ] Check the latest Prometheus release:
31+
<https://hub.docker.com/r/prom/prometheus/tags>
32+
- [ ] Run Trivy against candidate newer tags:
33+
`trivy image --severity HIGH,CRITICAL prom/prometheus:LATEST_TAG`
34+
- [ ] Compare results against the v3.5.1 baseline in
35+
`docs/security/docker/scans/prometheus.md`
36+
- [ ] **If CRITICALs are cleared**: update `src/domain/prometheus/config.rs` and
37+
the CI scan matrix; update the scan doc; post results comment; close #433
38+
- [ ] **If CRITICALs remain**: post comment documenting which CVEs remain and why
39+
they cannot be fixed (upstream binary); add revisit note to #433; leave open
40+
41+
## Outcome
42+
43+
<!-- Fill in after doing the work -->
44+
45+
- Date:
46+
- Latest Prometheus tag tested:
47+
- Findings (HIGH / CRITICAL):
48+
- Decision: upgrade / accept risk / leave open
49+
- Comment/PR:

‎docs/issues/434-grafana-cves.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Issue #434: Grafana CVEs after upgrade to 12.4.2
2+
3+
**GitHub**: <https://github.com/torrust/torrust-tracker-deployer/issues/434>
4+
**Image**: `grafana/grafana:12.4.2`
5+
**Default set in**: `src/domain/grafana/config.rs`
6+
7+
---
8+
9+
## Context
10+
11+
After PR #436 upgraded Grafana from `12.3.1` to `12.4.2`:
12+
13+
| Version | HIGH | CRITICAL |
14+
| -------- | ---- | -------- |
15+
| `12.3.1` | 18 | 6 |
16+
| `12.4.2` | 4 | 0 |
17+
18+
CRITICALs are fully cleared. 4 HIGH remain in upstream binary dependencies.
19+
20+
## Decision
21+
22+
**Re-scan with latest Grafana tag, then decide**:
23+
24+
- If a newer tag clears remaining HIGH: upgrade, update scan doc, close #434
25+
- If not: post comment with scan results confirming no CRITICALs, document accepted
26+
risk, close #434
27+
28+
## Steps
29+
30+
- [ ] Check the latest Grafana release:
31+
<https://hub.docker.com/r/grafana/grafana/tags>
32+
- [ ] Run Trivy against the latest tag:
33+
`trivy image --severity HIGH,CRITICAL grafana/grafana:LATEST_TAG`
34+
- [ ] Compare results against the 12.4.2 baseline in
35+
`docs/security/docker/scans/grafana.md`
36+
- [ ] **If a newer tag reduces HIGH count**: update `src/domain/grafana/config.rs`
37+
and the CI scan matrix; update the scan doc; post results comment; close #434
38+
- [ ] **If no improvement**: post comment with current scan output confirming
39+
no CRITICALs and document accepted risk for remaining HIGH; close #434
40+
41+
## Outcome
42+
43+
<!-- Fill in after doing the work -->
44+
45+
- Date:
46+
- Latest Grafana tag tested:
47+
- Findings (HIGH / CRITICAL):
48+
- Decision: upgrade / accept risk
49+
- Comment/PR:

‎docs/issues/435-mysql-cves.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Issue #435: MySQL CVEs in mysql:8.4
2+
3+
**GitHub**: <https://github.com/torrust/torrust-tracker-deployer/issues/435>
4+
**Image**: `mysql:8.4` (floating tag, resolved to `8.4.8` at time of last scan)
5+
6+
---
7+
8+
## Context
9+
10+
Current findings for `mysql:8.4`: **7 HIGH, 1 CRITICAL**.
11+
12+
Findings are in helper components (`gosu` and Python packages), not MySQL server
13+
core. Investigation during PR #436 found that pinning to specific minor tags
14+
(8.4.1–9.1) results in 98–100 HIGH — the floating `mysql:8.4` tag is already
15+
the best available option.
16+
17+
## Decision
18+
19+
**Re-scan to check if the floating tag now resolves to a newer patch, then decide**:
20+
21+
- If the floating tag now resolves to a patch where `gosu`/Python CVEs are fixed:
22+
document the improvement. No code change needed (it's a floating tag).
23+
- If still no practical fix: post comment confirming accepted risk and close #435
24+
25+
## Steps
26+
27+
- [ ] Pull and scan the current floating tag:
28+
`docker pull mysql:8.4 && trivy image --severity HIGH,CRITICAL mysql:8.4`
29+
- [ ] Check which patch the floating tag currently resolves to:
30+
`docker inspect mysql:8.4 | grep -i version`
31+
- [ ] Compare results against the 8.4.8 baseline in
32+
`docs/security/docker/scans/mysql.md`
33+
- [ ] Check if `mysql:9.x` is now a viable option for the deployer (compatibility,
34+
LTS status):
35+
<https://hub.docker.com/_/mysql>
36+
- [ ] **If CVE count has dropped**: update the scan doc; post comment; close #435
37+
- [ ] **If still 7 HIGH / 1 CRITICAL with no viable upgrade path**: post comment
38+
documenting accepted risk (helper components, not MySQL core); close #435
39+
40+
## Outcome
41+
42+
<!-- Fill in after doing the work -->
43+
44+
- Date:
45+
- Floating tag resolves to:
46+
- Findings (HIGH / CRITICAL):
47+
- Decision: accepted risk / upgrade to mysql:9.x
48+
- Comment/PR:

‎docs/issues/443-rand-0.8.5-rustsec.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# Issue #443: RUSTSEC-2026-0097 — `rand 0.8.5` unsound (transitive)
2+
3+
**GitHub**: <https://github.com/torrust/torrust-tracker-deployer/issues/443>
4+
**Advisory**: <https://rustsec.org/advisories/RUSTSEC-2026-0097.html>
5+
**Affected**: `rand >= 0.7, < 0.9.3` and `0.10.0`
6+
**Reported version**: `0.8.5`
7+
8+
---
9+
10+
## Context
11+
12+
`rand 0.8.5` is a transitive dependency via `tera v1.20.1`. It cannot be
13+
directly upgraded — only a new `tera` release that bumps its own rand dependency
14+
will clear it.
15+
16+
Current dependency paths (`cargo tree -i rand@0.8.5`):
17+
18+
```text
19+
rand v0.8.5
20+
└── tera v1.20.1
21+
└── torrust-tracker-deployer v0.1.0
22+
23+
rand v0.8.5
24+
└── phf_generator v0.11.3
25+
└── phf_codegen v0.11.3
26+
└── chrono-tz-build v0.3.0
27+
[build-dependencies]
28+
└── chrono-tz v0.9.0
29+
└── tera v1.20.1 (*)
30+
```
31+
32+
## Risk Assessment
33+
34+
The unsoundness requires **all** of the following conditions simultaneously:
35+
36+
1. The `log` and `thread_rng` features of `rand 0.8.5` are both enabled
37+
2. A custom logger is registered
38+
3. The custom logger calls `rand::rng()` inside its logging code
39+
4. `ThreadRng` attempts to reseed (every 64 kB of random output)
40+
5. Trace-level or warn-level (with getrandom failure) logging is active
41+
42+
This application does **not** implement a custom logger that calls back into rand.
43+
Only `tera` uses `rand 0.8.5` for template rendering — it does not trigger the
44+
logging path.
45+
46+
**Conclusion**: Low practical risk — the conditions for unsoundness are not met.
47+
48+
## Decision
49+
50+
**Post a comment with the risk assessment, then leave open** until `tera` releases
51+
a version using `rand >= 0.9.3`.
52+
53+
## Steps
54+
55+
- [ ] Run `cargo audit` to confirm RUSTSEC-2026-0097 is still reported for rand 0.8.5
56+
- [ ] Run `cargo tree -i rand@0.8.5` to confirm `tera` is still the only consumer
57+
- [ ] Check whether `tera` has released a version with `rand >= 0.9.3`:
58+
<https://crates.io/crates/tera>
59+
- [ ] **If `tera` has not updated yet**:
60+
- Post a comment on #443 with the risk assessment above and the cargo tree output
61+
- Leave the issue open with a note to revisit on the next `tera` minor release
62+
- [ ] **If `tera` is updated**:
63+
- Bump `tera` in `Cargo.toml`, run `cargo update tera`
64+
- Run `cargo tree -p rand` to confirm `rand 0.8.5` is gone from `Cargo.lock`
65+
- Run `cargo audit` to confirm the advisory is cleared
66+
- Post a comment with the results and close #443
67+
68+
## Outcome
69+
70+
<!-- Fill in after doing the work -->
71+
72+
- Date:
73+
- tera latest version:
74+
- Result:
75+
- Comment/PR:

0 commit comments

Comments
 (0)