mirror of
https://github.com/linuxserver/cstate.git
synced 2026-02-20 07:55:25 +08:00
45 lines
9.4 KiB
XML
45 lines
9.4 KiB
XML
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><link rel="alternate" type="text/html" href="https://info.linuxserver.io"/><title>Vulnerabilities on Info :: LinuxServer.io</title><link>https://info.linuxserver.io/affected/vulnerabilities/</link><description>History</description><generator>github.com/cstate</generator><language>en</language><lastBuildDate>2024-03-29T22:00:00+00:00</lastBuildDate><updated>2024-03-29T22:00:00+00:00</updated><atom:link href="https://info.linuxserver.io/affected/vulnerabilities/index.xml" rel="self" type="application/rss+xml"/><item><title>[Resolved] Regarding CVE-2024-3094 - Supply Chain Compromise Affecting XZ Utils</title><link>https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/</link><pubDate>Fri, 29 Mar 2024 22:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2024-03-29-cve-2024-3094/</guid><category>2024-04-10 22:00:00Z</category><description>Update - 2024-04-10 At this point we are comfortable that there was and is no risk to any of our images as a result of the XZ backdoor and are considering the issue resolved.
|
|
Update - 2024-03-30 Further analysis of the exploit code indicates that it is only functional on amd64 hardware running glibc and a deb or rpm-based Linux distribution. The original CISA alert stated that the exploit could allow remote code execution, however, it remains unclear exactly what the payload was intended to do and so they have changed their description to &ldquo;may allow unauthorized access to affected systems&rdquo;.</description><content type="html"><h3 id="update---2024-04-10">Update - 2024-04-10</h3>
|
|
<p>At this point we are comfortable that there was and is no risk to any of our images as a result of the XZ backdoor and are considering the issue resolved.</p>
|
|
<h3 id="update---2024-03-30">Update - 2024-03-30</h3>
|
|
<p>Further analysis of the exploit code indicates that it is only functional on amd64 hardware running glibc and a deb or rpm-based Linux distribution. The original CISA alert stated that the exploit could allow remote code execution, however, it remains unclear exactly what the payload was intended to do and so they have changed their description to &ldquo;may allow unauthorized access to affected systems&rdquo;.</p>
|
|
<p>As best we can tell at this point, none of our images were or are impacted by this vulnerability, but our original recommendations remain in place.</p>
|
|
<h3 id="original-post">Original Post</h3>
|
|
<p>A supply chain compromise has been discovered in the XZ Utils data compression library, being tracked under <a href="https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094">CVE-2024-3094</a>, which could allow remote code execution under certain circumstances. The original report is available <a href="https://www.openwall.com/lists/oss-security/2024/03/29/4">here</a> if you are interested in the technical details.</p>
|
|
<p>We have evaluated all of our current base images for indications that they may be vulnerable to this exploit:</p>
|
|
<ul>
|
|
<li>Our Ubuntu, Debian, and Fedora base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.</li>
|
|
<li>Our Arch base image did contain an affected version of XZ Utils, and we have now pushed an updated build that includes a fixed version of the XZ package.</li>
|
|
<li>Our Alpine Edge base image did contain an affected version of XZ Utils, but did not appear to be vulnerable due to the exploit&rsquo;s dependency on glibc, and we have now pushed an updated build that includes a fixed version of the XZ package.</li>
|
|
<li>Our other Alpine base images are using older versions of XZ Utils which do not appear to contain the vulnerable code.</li>
|
|
</ul>
|
|
<p>So far the only exploitation path that has been observed is via SSH, and so in the vast majority of cases could not be exploited in any of our container environments, but we always recommend that you ensure any internet-facing containers are properly secured and kept up to date.</p>
|
|
<p>We will update this post as and when more information becomes available.</p></content></item><item><title>[Resolved] log4j Vulnerability</title><link>https://info.linuxserver.io/issues/2021-12-13-log4j/</link><pubDate>Mon, 13 Dec 2021 15:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2021-12-13-log4j/</guid><category>2022-02-18 18:00:00Z</category><description>Update At this time we have determined that all application/container updates or mitigations that we can reasonably provide have been actioned and as such are marking this issue as resolved.
|
|
Original Post Multiple vulnerabilities (CVE-2021-44228 and CVE-2021-45046) have been discovered in log4j which can lead to denial of service and remote code execution. The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 or CVE-2021-45046 due to existing mitigations, upstream patches, or workarounds applied to the container images.</description><content type="html"><h3 id="update">Update</h3>
|
|
<p>At this time we have determined that all application/container updates or mitigations that we can reasonably provide have been actioned and as such are marking this issue as resolved.</p>
|
|
<h3 id="original-post">Original Post</h3>
|
|
<p>Multiple vulnerabilities (<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228">CVE-2021-44228</a> and <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-45046">CVE-2021-45046</a>) have been discovered in log4j which can lead to denial of service and remote code execution. The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 <em>or</em> CVE-2021-45046 due to existing mitigations, upstream patches, or workarounds applied to the container images.</p>
|
|
<p><strong>Please note these lists apply to the stated version tags and later <em>only</em>. If you are running older versions of the images they may still be vulnerable.</strong></p>
|
|
<ul>
|
|
<li><a href="https://github.com/linuxserver/docker-fleet">Fleet</a> - <code>version-2.3.2</code> and later (Workaround applied + upstream fix)</li>
|
|
<li><a href="https://github.com/linuxserver/docker-airsonic">Airsonic</a> (No log4j-core in use)</li>
|
|
<li><a href="https://github.com/linuxserver/docker-habridge">HABridge</a> (No log4j-core in use)</li>
|
|
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.55</code> and later (Workaround applied + upstream fix)</li>
|
|
<li><a href="https://github.com/linuxserver/docker-davos">Davos</a> <code>version-2.2.2</code> and later (Upstream fix)</li>
|
|
<li><a href="https://github.com/linuxserver/docker-booksonic-air/">Booksonic Air</a> - <code>version-v2112.2.0</code> and later (Upstream fix)</li>
|
|
</ul>
|
|
<p>The following Linuxserver containers have been confirmed not to be affected by CVE-2021-44228 due to existing mitigations, upstream patches, or workarounds applied to the container images, but may still be vulnerable to CVE-2021-45046.</p>
|
|
<ul>
|
|
<li><a href="https://github.com/linuxserver/docker-unifi-controller">Unifi Controller</a> - <code>version-6.5.54</code> and later (Workaround applied + upstream fix)</li>
|
|
<li><a href="https://github.com/linuxserver/docker-booksonic-air/">Booksonic Air</a> - <code>version-v2112.1.0</code> and later (Upstream fix)</li>
|
|
<li><a href="https://github.com/linuxserver/docker-nzbhydra2">nzbhydra2</a> - <code>version-v3.18.4</code> and later (Upstream fix)</li>
|
|
</ul>
|
|
<p>The following Linuxserver containers are known to be using a vulnerable version of log4j in their current versions and cannot be mitigated by us. This does not mean they are definitely exploitable, but they may be, especially if exposed to the internet.</p>
|
|
<ul>
|
|
<li><a href="https://github.com/linuxserver/docker-booksonic">Booksonic</a> (Deprecated)</li>
|
|
</ul>
|
|
<p>The following Linuxserver containers are unconfirmed as to their vulnerability status, but are Java-based and so may be using log4j in some capacity.</p>
|
|
<ul>
|
|
<li><a href="https://github.com/linuxserver/docker-ubooquity">Ubooquity</a></li>
|
|
</ul>
|
|
<p>We will update this post as more information becomes available.</p></content></item><item><title>[Resolved] Authelia Vulnerability</title><link>https://info.linuxserver.io/issues/2021-05-30-authelia/</link><pubDate>Sun, 30 May 2021 00:00:00 +0000</pubDate><guid>https://info.linuxserver.io/issues/2021-05-30-authelia/</guid><category>2021-05-30</category><description>A vulnerability has been discovered in Authelia versions prior to 4.29.3 when used with nginx which can result in an authentication bypass. To ensure you are protected please upgrade to at least Authelia version 4.29.3 and/or Swag version 1.15.0-ls63.</description><content type="html"><p>A <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-32637">vulnerability</a> has been discovered in Authelia versions prior to 4.29.3 when used with nginx which can result in an authentication bypass. To ensure you are protected please upgrade to at least Authelia version 4.29.3 and/or Swag version 1.15.0-ls63.</p></content></item></channel></rss> |