R-1303 built and live-proven (test mail arrived, seed run committed its memory); R-1305–R-1309 filed (file manager, 27 apps, image packages, floating tags, mail-only notices); docs 08 §11, B23, monthly §4a; STATUS
gates / gates (push) Successful in 2m21s
gates / gates (push) Successful in 2m21s
This commit is contained in:
admin committed
1 parent
ed843da788
commit
626275b187
10 files changed
+2465
-14
No files matched your search
@@ -0,0 +1,39 @@
|
||||
# Open advisories at the first run — 2026-10-26 (security watch seed, CI job 2408)
|
||||
|
||||
One row per pin. „Fixed in" lists every fixed version the notices name. A seed mails nothing; this is the list it
|
||||
would have mailed. Box programs first. Full text: `ci-seed.log` (WOULD HAVE MAILED).
|
||||
|
||||
| Program (owner) | Our version | Notices | Fixed in | Worst severity | Sources |
|
||||
|---|---|---|---|---|---|
|
||||
| cloudflare/cloudflared (controller infra) | 2026.10.3 | 2 | 2026.10.4; read the notice | not given | release notes (cloudflared), vendor notice (cloudflare-blog) |
|
||||
| gtstef/filebrowser (controller infra) | 1.5.6-stable | 36 | 1.5.7-stable, 2.0.10-beta; 1.5.7-stable, 2.0.8-beta; 2.0.0-stable; 2.0.0-stable, 2.0.10-beta; 2.0.1-stable; 2.0.1-stable | high | GitHub advisory, release notes |
|
||||
| traefik (controller infra) | v3.7.13 | 15 | v3.7.14; v3.7.15; v3.7.16 | high | GitHub advisory, release notes |
|
||||
| codewithcj/sparkyfitness (sparkyfitness) | v0.17.3 | 3 | no fixed version named yet | medium | GitHub advisory |
|
||||
| codewithcj/sparkyfitness_server (sparkyfitness) | v0.17.3 | 3 | no fixed version named yet | medium | GitHub advisory |
|
||||
| docmost/docmost (docmost) | 0.96.0 | 1 | v0.97.0 | not given | release notes |
|
||||
| f0rc3/gokapi (gokapi) | v1.9.6 | 10 | 2.2.3; 2.2.4; v2.0.0 | high | GitHub advisory |
|
||||
| fallenbagel/jellyseerr (seerr) | 2.7.3 | 6 | 3.1.0; 3.4.0; 3.5.0 | high | GitHub advisory |
|
||||
| flomp/wanderer-db (wanderer) | v0.20.0 | 11 | v0.21.0; v0.21.2 | critical | GitHub advisory, release notes |
|
||||
| flomp/wanderer-web (wanderer) | v0.20.0 | 11 | v0.21.0; v0.21.2 | critical | GitHub advisory, release notes |
|
||||
| freikin/dawarich (dawarich) | 1.15.3 | 1 | 1.17.0 | not given | release notes |
|
||||
| ghcr.io/advplyr/audiobookshelf (audiobookshelf) | 2.37.1 | 1 | v2.37.2 | not given | release notes |
|
||||
| ghcr.io/alam00000/bentopdf (bentopdf) | v2.8.6 | 5 | no fixed version named yet; v2.8.10; v2.8.7 | medium | GitHub advisory, release notes |
|
||||
| ghcr.io/cmintey/wishlist (wishlist) | v0.67.1 | 2 | v0.68.0; v0.69.0 | not given | release notes |
|
||||
| ghcr.io/home-assistant/home-assistant (home-assistant) | 2026.9.4 | 1 | the range is unreadable — check by hand | low | GitHub advisory |
|
||||
| ghcr.io/immich-app/immich-machine-learning (immich) | v3.2.4 | 2 | the range is unreadable — check by hand; v3.3.5 | critical | GitHub advisory, release notes |
|
||||
| ghcr.io/immich-app/immich-server (immich) | v3.2.4 | 2 | the range is unreadable — check by hand; v3.3.5 | critical | GitHub advisory, release notes |
|
||||
| ghcr.io/karakeep-app/karakeep (karakeep) | 0.33.2 | 3 | no fixed version named yet; v0.34.0; v0.34.1 | high | GitHub advisory, release notes |
|
||||
| ghcr.io/sysadminsmedia/homebox (homebox) | 0.26.2 | 2 | v0.27.0; v0.27.1 | not given | release notes |
|
||||
| ghcr.io/tandoorrecipes/recipes (tandoor) | 2.6.15 | 1 | 2.7.0 | not given | release notes |
|
||||
| grafana/grafana (grafana) | 13.2.3 | 1 | v13.2.4 | not given | release notes |
|
||||
| jellyfin/jellyfin (jellyfin) | 10.11.11 | 6 | 12.0 | critical | GitHub advisory |
|
||||
| louislam/uptime-kuma (uptime-kuma) | 2.5.5 | 4 | 2.5.6; 2.5.7; 2.5.8; the range is unreadable — check by hand | medium | GitHub advisory, release notes |
|
||||
| lscr.io/linuxserver/bookstack (bookstack) | 26.09.1 | 1 | v26.09.2 | not given | release notes |
|
||||
| lscr.io/linuxserver/code-server (code-server) | 4.129.0 | 1 | v4.141.1 | not given | release notes |
|
||||
| lukevella/rallly (rallly) | 4.15.3 | 5 | 4.15.4; v4.15.4; v4.15.5; v4.16.0; v4.16.2 | critical | GitHub advisory, release notes |
|
||||
| outlinewiki/outline (outline) | 1.10.1 | 1 | v1.12.0 | not given | release notes |
|
||||
| privatebin/pdo (privatebin) | 2.0.6 | 1 | 2.1.0 | not given | release notes |
|
||||
| rommapp/romm (romm) | 5.3.1 | 2 | 5.4.0; 5.4.1 | not given | release notes |
|
||||
| vikunja/vikunja (vikunja) | 2.6.0 | 2 | v2.7.0; v2.7.1 | not given | release notes |
|
||||
|
||||
142 notices on 30 pins.
|
||||
@@ -0,0 +1,764 @@
|
||||
felhom-gates-runner-2(version:v0.6.1) received task 2427 of job watch, be triggered by event: workflow_dispatch
|
||||
workflow prepared
|
||||
evaluating expression 'success()'
|
||||
expression 'success()' evaluated to 'true'
|
||||
evaluating expression ''
|
||||
expression '' evaluated to 'true'
|
||||
⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
|
||||
Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
|
||||
::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
base=http://gitea.gitea-system.svc.cluster.local:3000/admin
|
||||
git init -q . && git remote add origin $base/felhom.eu.git
|
||||
git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
|
||||
for r in felhom-controller app-catalog-felhom.eu; do
|
||||
git init -q ../$r && git -C ../$r remote add origin $base/$r.git
|
||||
git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
|
||||
echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
|
||||
done
|
||||
shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
::endgroup::
|
||||
felhom.eu main at 1f62d629158c
|
||||
felhom-controller at e01eb64b2591
|
||||
app-catalog-felhom.eu at f61800aae945
|
||||
::group::Run set -u
|
||||
set -u
|
||||
mkdir -p documentation/security-watch
|
||||
mode="${MODE:-run}"
|
||||
[ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
|
||||
echo "mode: $mode"
|
||||
case "$mode" in
|
||||
test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
|
||||
dry) extra="--no-mail" ; state=/tmp/state-dry.json
|
||||
cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
|
||||
seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
|
||||
run) extra="" ; state=documentation/security-watch/state.json ;;
|
||||
*) echo "unknown mode $mode"; exit 2 ;;
|
||||
esac
|
||||
python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
|
||||
--controller=../felhom-controller --json=/tmp/watch-results.json $extra
|
||||
shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
env:
|
||||
RESEND_API_KEY: ***
|
||||
GH_ADVISORY_TOKEN:
|
||||
MODE: dry
|
||||
::endgroup::
|
||||
mode: dry
|
||||
/root/.cache/act/6ed0fc4eeecacefe/hostexecutor/scripts/security_watch.py:687: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
|
||||
today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
security watch 2026-10-26: 108 pins (11 box/build, 97 app); GitHub key ABSENT — apps' advisories in a 2-night rotation
|
||||
ADVISORY box cloudflare/cloudflared 2026.10.3 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.4:VULN-176088 (fixed 2026.10.4)
|
||||
ADVISORY box gtstef/filebrowser 1.5.6-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more
|
||||
ADVISORY box traefik v3.7.13 GHSA-hrpp-p4fc-wwf8 (fixed v3.7.16); GHSA-p8wx-ph99-xgcr (fixed v3.7.15); GHSA-fh26-gfpp-7xxx (fixed v3.7.14); GHSA-qvj7-gq9c-hp7q (fixed v3.7.14); … 11 more
|
||||
ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0)
|
||||
ADVISORY app ghcr.io/sysadminsmedia/homebox 0.26.2 release:sysadminsmedia/homebox@v0.27.1 (fixed v0.27.1); release:sysadminsmedia/homebox@v0.27.0 (fixed v0.27.0)
|
||||
ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 release:TandoorRecipes/recipes@2.7.0 (fixed 2.7.0)
|
||||
ADVISORY app grafana/grafana 13.2.3 release:grafana/grafana@v13.2.4 (fixed v13.2.4)
|
||||
ADVISORY app lscr.io/linuxserver/bookstack 26.09.1 release:BookStackApp/BookStack@v26.09.2 (fixed v26.09.2)
|
||||
ADVISORY app lscr.io/linuxserver/code-server 4.129.0 release:coder/code-server@v4.141.1 (fixed v4.141.1)
|
||||
ADVISORY app outlinewiki/outline 1.10.1 release:outline/outline@v1.12.0 (fixed v1.12.0)
|
||||
ADVISORY app privatebin/pdo 2.0.6 release:PrivateBin/PrivateBin@2.1.0 (fixed 2.1.0)
|
||||
ADVISORY app rommapp/romm 5.3.1 release:rommapp/romm@5.4.1 (fixed 5.4.1); release:rommapp/romm@5.4.0 (fixed 5.4.0)
|
||||
ADVISORY app vikunja/vikunja 2.6.0 release:go-vikunja/vikunja@v2.7.1 (fixed v2.7.1); release:go-vikunja/vikunja@v2.7.0 (fixed v2.7.0)
|
||||
NOT CHECKED app codewithcj/sparkyfitness v0.17.3 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app codewithcj/sparkyfitness_server v0.17.3 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app crocodilestick/calibre-web-automated v4.0.8 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app docmost/docmost 0.96.0 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app f0rc3/gokapi v1.9.6 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app fallenbagel/jellyseerr 2.7.3 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app flomp/wanderer-db v0.20.0 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app flomp/wanderer-web v0.20.0 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/advplyr/audiobookshelf 2.37.1 GitHub API rate limit (403)
|
||||
NOT CHECKED app ghcr.io/alam00000/bentopdf v2.8.6 GitHub API rate limit (403)
|
||||
NOT CHECKED app ghcr.io/cmintey/wishlist v0.67.1 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/gramps-project/grampsweb v25.6.0 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/grimmory-tools/grimmory v3.5.0 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/hargata/lubelogger v1.7.3 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/home-assistant/home-assistant 2026.9.4 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/immich-app/immich-machine-learning v3.2.4 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/immich-app/immich-server v3.2.4 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/karakeep-app/karakeep 0.33.2 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/kozea/radicale 3.8.1 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app ghcr.io/seanmorley15/adventurelog-backend v0.13.0 GitHub API rate limit (403)
|
||||
NOT CHECKED app jellyfin/jellyfin 10.11.11 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app kimai/kimai2 2.67.0 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app louislam/uptime-kuma 2.5.5 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app lscr.io/linuxserver/grocy 4.7.1 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app lscr.io/linuxserver/sonarr 4.0.20 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app lukevella/rallly 4.15.3 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app msdeluise/plant-it 0.10.0 GitHub API rate limit reached earlier tonight; Docker registry tags of msdeluise/plant-it: HTTP 401
|
||||
NOT CHECKED app nextcloud 34.0.4-apache GitHub API rate limit reached earlier tonight; GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app onlyoffice/documentserver 9.4.0 GitHub API rate limit reached earlier tonight
|
||||
NOT CHECKED app qbittorrentofficial/qbittorrent-nox 5.2.4-1 GitHub API rate limit reached earlier tonight
|
||||
BEHIND app actualbudget/actual-server 26.9.0 newest 26.10.0
|
||||
BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
|
||||
BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
|
||||
BEHIND app ghcr.io/alexta69/metube 2026.09.29 newest 2026.10.25
|
||||
BEHIND app ghcr.io/lukegus/termix 2.8.0 newest 2.9.2
|
||||
BEHIND app ghcr.io/mealie-recipes/mealie v3.28.0 newest v3.29.0
|
||||
BEHIND app ghcr.io/papra-hq/papra 26.6.2-rootless newest 26.7.1-rootless
|
||||
BEHIND app ghost 6.67.0-alpine newest 6.72.0-alpine
|
||||
BEHIND app glanceapp/glance v0.8.5 newest v0.8.7
|
||||
BEHIND app gotson/komga 1.28.0 newest 1.29.1
|
||||
BEHIND app n8nio/n8n 2.42.1 newest 2.45.4
|
||||
BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
|
||||
GAP buil alpine 3.24.2 newest 3.24.3
|
||||
GAP buil alpine 3.24.2 newest 3.24.3
|
||||
GAP buil debian 13.7-slim
|
||||
GAP buil debian 13.7-slim
|
||||
GAP app emby/embyserver 4.11.0.4 newest 4.11.0.10
|
||||
GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
|
||||
GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
|
||||
GAP app mariadb 12.3
|
||||
GAP app mariadb 11.4 newest 11.8
|
||||
GAP app mariadb 11.8
|
||||
GAP app mariadb 12.3
|
||||
GAP app mariadb 11.8
|
||||
GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
GAP app postgis/postgis 16-3.5-alpine
|
||||
GAP app postgis/postgis 17-3.5-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 17-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 17-alpine
|
||||
GAP app postgres 16-alpine
|
||||
GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
|
||||
FLOATING app ghcr.io/claperco/claper 2.5
|
||||
FLOATING app ghcr.io/thomiceli/opengist 1.15
|
||||
FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
|
||||
FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
|
||||
FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
|
||||
FLOATING app nzbgetcom/nzbget v26.3
|
||||
FLOATING app redis 7.4-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app wger/server 2.7
|
||||
SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
|
||||
SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
|
||||
CURRENT buil golang 1.27.3-trixie
|
||||
CURRENT buil golang 1.27.3-alpine3.24
|
||||
CURRENT buil restic 0.19.1
|
||||
CURRENT app calcom/cal.com v6.2.0
|
||||
CURRENT app deluan/navidrome 0.64.2
|
||||
CURRENT app ghcr.io/diced/zipline 4.8.0
|
||||
CURRENT app ghcr.io/gethomepage/homepage v1.13.2
|
||||
CURRENT app ghcr.io/paperless-ngx/paperless-ngx 2.20.15
|
||||
CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0
|
||||
CURRENT app gitea/gitea 1.27.3
|
||||
CURRENT app lscr.io/linuxserver/radarr 6.4.4
|
||||
CURRENT app vaultwarden/server 1.37.4-alpine
|
||||
COUNTS ADVISORY=13 BEHIND=12 CURRENT=12 FLOATING=14 GAP=25 NOT_CHECKED=30 SELF=2
|
||||
REQUESTS api.github.com=8 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=52 github.com=34 hub.docker.com=145 raw.githubusercontent.com=1 registry-1.docker.io=1
|
||||
WOULD HAVE MAILED (seed): [Felhom security] cloudflared, filebrowser, traefik, dawarich … — 66 new advisories
|
||||
The nightly security watch (felhom.eu R-1303) found a notice that affects a version we ship.
|
||||
|
||||
Box programs first.
|
||||
|
||||
cloudflare/cloudflared — feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3
|
||||
What: 8 eMudhra certificates are compromised. Here's what you need to know
|
||||
Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage)
|
||||
Fixed in: read the notice
|
||||
Severity: not given
|
||||
Source: vendor notice (cloudflare-blog)
|
||||
Link: https://blog.cloudflare.com/emudhra-certificate-compromise/
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
cloudflare/cloudflared — vulnnotes:cloudflared@2026.10.4:VULN-176088
|
||||
What: - 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server
|
||||
Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage)
|
||||
Fixed in: 2026.10.4
|
||||
Severity: not given
|
||||
Source: release notes (cloudflared)
|
||||
Link: https://raw.githubusercontent.com/cloudflare/cloudflared/master/RELEASE_NOTES
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-26fh-r34c-qxh6
|
||||
What: Moving or renaming a folder retargets public shares to the whole folder
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.2-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-26fh-r34c-qxh6
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-3846-gh75-gp3m
|
||||
What: Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 1.5.7-stable, 2.0.8-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3846-gh75-gp3m
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-3j46-5w28-f8p2
|
||||
What: Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.1.0-stable, 2.1.3-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3j46-5w28-f8p2
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-4fhx-8pf6-5gmr
|
||||
What: Duplicate finder can show another user’s restricted file names from a shared cache
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.2-stable, 2.1.3-beta
|
||||
Severity: low
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4fhx-8pf6-5gmr
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-4v62-884x-2466
|
||||
What: Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.1.0-stable, 2.1.3-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4v62-884x-2466
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-4vrc-935w-xxq2
|
||||
What: Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonicalization
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.1.0-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4vrc-935w-xxq2
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-4wmj-rq3c-m65v
|
||||
What: Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: >= 2.0.1-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4wmj-rq3c-m65v
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-55mw-cwg7-m8f5
|
||||
What: `GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.5-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-55mw-cwg7-m8f5
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-6gr6-5qpq-888p
|
||||
What: Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.10-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-6gr6-5qpq-888p
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-8655-2ph3-q7q7
|
||||
What: Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.2-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8655-2ph3-q7q7
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-8m35-wcjh-95q7
|
||||
What: Logout Bypass via Alternate JWT Spelling
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: >= 2.0.1-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8m35-wcjh-95q7
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-9fcr-gm58-p839
|
||||
What: Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.1.0-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9fcr-gm58-p839
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-9wm6-jcjh-3m8c
|
||||
What: Stored XSS via Unsanitized DOCX Hyperlink in DocViewer
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: >=2.0.1-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9wm6-jcjh-3m8c
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-c7pj-xjp9-x4xp
|
||||
What: Read-only users can overwrite files through PUT /api/resources
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.0-stable
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c7pj-xjp9-x4xp
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-c84q-q5g6-r47f
|
||||
What: createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.1-stable, 2.1.2-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c84q-q5g6-r47f
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-c9cr-w724-gqj3
|
||||
What: Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.1-stable
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c9cr-w724-gqj3
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-cw65-p35p-633w
|
||||
What: FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: >= 2.0.0-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-cw65-p35p-633w
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-g2q5-r6ch-v25f
|
||||
What: FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.1.0-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-g2q5-r6ch-v25f
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-gfgm-886h-6r47
|
||||
What: Custom API token with no global caps inherits owner admin access
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.2-stable, 2.1.4-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-gfgm-886h-6r47
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-mgqf-5mf5-prfj
|
||||
What: Symlink following escapes user scope allowing arbitrary file read outside the served directory
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: >= 2.0.1-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-p7x3-p5jj-9xfh
|
||||
What: Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.0-stable, 2.0.10-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p7x3-p5jj-9xfh
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-p93p-v944-4p44
|
||||
What: Unarchive writes into folders denied by access rules and overwrites files without modify permission
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.1.0-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p93p-v944-4p44
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-p9wm-f5jj-75pj
|
||||
What: FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.2-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p9wm-f5jj-75pj
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-qqf3-2wvq-q4w9
|
||||
What: Archive download follows symlinks out of source scope (arbitrary file read)
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.1.0-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqf3-2wvq-q4w9
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-qv53-4557-m65h
|
||||
What: Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: >= v2.0.0-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qv53-4557-m65h
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-qx86-4v5r-26g5
|
||||
What: MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 1.5.7-stable, 2.0.10-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qx86-4v5r-26g5
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-r744-4vm3-2px3
|
||||
What: Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and password changes
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.2-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r744-4vm3-2px3
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-rmjp-pfrq-cc3v
|
||||
What: Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.2-stable, 2.1.3-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rmjp-pfrq-cc3v
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-rqqq-wv83-rp74
|
||||
What: Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: >= v2.0.1-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rqqq-wv83-rp74
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-vvm6-jwrf-hgmg
|
||||
What: Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.3-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvm6-jwrf-hgmg
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-wfjp-qhvc-69wp
|
||||
What: Share path re-point allows scope escape (arbitrary read/write across the source root)
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: >= 2.0.0-beta
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wfjp-qhvc-69wp
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-wjp8-g49g-xrhx
|
||||
What: Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.1.0-stable, 2.1.3-beta
|
||||
Severity: low
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wjp8-g49g-xrhx
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-wxj5-g3qp-g732
|
||||
What: Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/api/resources/view)
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: 2.0.2-stable, 2.1.3-beta
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wxj5-g3qp-g732
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — GHSA-x79q-5hqm-x839
|
||||
What: Share authorization gaps let read-only users delete files
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: >= 2.0.0-stable
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-x79q-5hqm-x839
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — release:gtsteffaniak/filebrowser@v1.5.7-stable
|
||||
What: [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; res
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: v1.5.7-stable
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.7-stable
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
gtstef/filebrowser — release:gtsteffaniak/filebrowser@v1.5.8-stable
|
||||
What: [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; res
|
||||
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
|
||||
Fixed in: v1.5.8-stable
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.8-stable
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-28hp-c82p-8vqj
|
||||
What: Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.15
|
||||
Severity: low
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-53qr-784g-cj35
|
||||
What: FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.14
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-cw35-4q88-3rmp
|
||||
What: Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.14
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-fh26-gfpp-7xxx
|
||||
What: snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.14
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-hrpp-p4fc-wwf8
|
||||
What: ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.16
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-mhjw-hmjv-p99x
|
||||
What: Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.14
|
||||
Severity: medium
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-mwrr-6hp4-pxr6
|
||||
What: Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.14
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-p8wx-ph99-xgcr
|
||||
What: ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.15
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-qm9f-w54v-q2qh
|
||||
What: Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.14
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-qvj7-gq9c-hp7q
|
||||
What: Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.14
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-rv2h-qh7j-xrjw
|
||||
What: Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.14
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — GHSA-ww7c-q3mv-xx22
|
||||
What: Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.15
|
||||
Severity: high
|
||||
Source: GitHub advisory
|
||||
Link: https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — release:traefik/traefik@v3.7.14
|
||||
What: Advisory GHSA-53qr-784g-cj35
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.14
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/traefik/traefik/releases/tag/v3.7.14
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — release:traefik/traefik@v3.7.15
|
||||
What: Advisory GHSA-p8wx-ph99-xgcr
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.15
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/traefik/traefik/releases/tag/v3.7.15
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
traefik — release:traefik/traefik@v3.7.16
|
||||
What: Advisory GHSA-hrpp-p4fc-wwf8
|
||||
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
|
||||
Fixed in: v3.7.16
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/traefik/traefik/releases/tag/v3.7.16
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
freikin/dawarich — release:Freika/dawarich@1.17.0
|
||||
What: js 20 package, which no longer receives upstream security fixes
|
||||
Our version: 1.15.3 (dawarich; templates/dawarich/.felhom.yml upstream: freikin/dawarich)
|
||||
Fixed in: 1.17.0
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/Freika/dawarich/releases/tag/1.17.0
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
ghcr.io/sysadminsmedia/homebox — release:sysadminsmedia/homebox@v0.27.0
|
||||
What: Security Issues Patched
|
||||
Our version: 0.26.2 (homebox; templates/homebox/.felhom.yml upstream: ghcr.io/sysadminsmedia/homebox)
|
||||
Fixed in: v0.27.0
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
ghcr.io/sysadminsmedia/homebox — release:sysadminsmedia/homebox@v0.27.1
|
||||
What: Warning This release is a security release to patch a NodeJS upstream vulnerability
|
||||
Our version: 0.26.2 (homebox; templates/homebox/.felhom.yml upstream: ghcr.io/sysadminsmedia/homebox)
|
||||
Fixed in: v0.27.1
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.1
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
ghcr.io/tandoorrecipes/recipes — release:TandoorRecipes/recipes@2.7.0
|
||||
What: fixed shopping list bulk API endpoint accepted IDs from foreign spaces GHSA-5p9v-743w-79h3
|
||||
Our version: 2.6.15 (tandoor; templates/tandoor/.felhom.yml upstream: ghcr.io/tandoorrecipes/recipes)
|
||||
Fixed in: 2.7.0
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/TandoorRecipes/recipes/releases/tag/2.7.0
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
grafana/grafana — release:grafana/grafana@v13.2.4
|
||||
What: Security: Fix CVE-2026-15577
|
||||
Our version: 13.2.3 (grafana; templates/grafana/.felhom.yml upstream: grafana/grafana)
|
||||
Fixed in: v13.2.4
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/grafana/grafana/releases/tag/v13.2.4
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
lscr.io/linuxserver/bookstack — release:BookStackApp/BookStack@v26.09.2
|
||||
What: Security Release
|
||||
Our version: 26.09.1 (bookstack; templates/bookstack/.felhom.yml upstream: lscr.io/linuxserver/bookstack)
|
||||
Fixed in: v26.09.2
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/BookStackApp/BookStack/releases/tag/v26.09.2
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
lscr.io/linuxserver/code-server — release:coder/code-server@v4.141.1
|
||||
What: Brotli decoder ( CVE-2026-111497 )
|
||||
Our version: 4.129.0 (code-server; templates/code-server/.felhom.yml upstream: lscr.io/linuxserver/code-server)
|
||||
Fixed in: v4.141.1
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/coder/code-server/releases/tag/v4.141.1
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
outlinewiki/outline — release:outline/outline@v1.12.0
|
||||
What: 1 which fixes multiple recently disclosed vulnerabilities
|
||||
Our version: 1.10.1 (outline; templates/outline/.felhom.yml upstream: outlinewiki/outline)
|
||||
Fixed in: v1.12.0
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/outline/outline/releases/tag/v1.12.0
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
privatebin/pdo — release:PrivateBin/PrivateBin@2.1.0
|
||||
What: More details on this issue can be found in the security advisory:
|
||||
Our version: 2.0.6 (privatebin; templates/privatebin/.felhom.yml upstream: privatebin/pdo)
|
||||
Fixed in: 2.1.0
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/PrivateBin/PrivateBin/releases/tag/2.1.0
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
rommapp/romm — release:rommapp/romm@5.4.0
|
||||
What: 0 [security] by @renovate [bot] in #4966
|
||||
Our version: 5.3.1 (romm; templates/romm/.felhom.yml upstream: rommapp/romm)
|
||||
Fixed in: 5.4.0
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/rommapp/romm/releases/tag/5.4.0
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
rommapp/romm — release:rommapp/romm@5.4.1
|
||||
What: While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible
|
||||
Our version: 5.3.1 (romm; templates/romm/.felhom.yml upstream: rommapp/romm)
|
||||
Fixed in: 5.4.1
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/rommapp/romm/releases/tag/5.4.1
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
vikunja/vikunja — release:go-vikunja/vikunja@v2.7.0
|
||||
What: 🔒 Six security fixes
|
||||
Our version: 2.6.0 (vikunja; templates/vikunja/.felhom.yml upstream: vikunja/vikunja)
|
||||
Fixed in: v2.7.0
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/go-vikunja/vikunja/releases/tag/v2.7.0
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
vikunja/vikunja — release:go-vikunja/vikunja@v2.7.1
|
||||
What: 🔒 A whopping 41(!) security fixes from community reports and an automated audit, reworked attachment previews, signed Docker images and a pile of bugfixes
|
||||
Our version: 2.6.0 (vikunja; templates/vikunja/.felhom.yml upstream: vikunja/vikunja)
|
||||
Fixed in: v2.7.1
|
||||
Severity: not given
|
||||
Source: release notes
|
||||
Link: https://github.com/go-vikunja/vikunja/releases/tag/v2.7.1
|
||||
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
|
||||
|
||||
A notice is mailed once, and again every 7 days while it stays open. Night of 2026-10-26.
|
||||
MAIL (not sent, --no-mail): [Felhom security] the watch's memory was missing — re-seeded
|
||||
STATE written: /tmp/state-dry.json (66 known advisories)
|
||||
Cleaning up container for job watch
|
||||
🏁 Job succeeded
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,52 @@
|
||||
felhom-gates-runner(version:v0.6.1) received task 2429 of job watch, be triggered by event: workflow_dispatch
|
||||
workflow prepared
|
||||
evaluating expression 'success()'
|
||||
expression 'success()' evaluated to 'true'
|
||||
evaluating expression ''
|
||||
expression '' evaluated to 'true'
|
||||
⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
|
||||
Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
|
||||
::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
|
||||
base=http://gitea.gitea-system.svc.cluster.local:3000/admin
|
||||
git init -q . && git remote add origin $base/felhom.eu.git
|
||||
git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
|
||||
echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
|
||||
for r in felhom-controller app-catalog-felhom.eu; do
|
||||
git init -q ../$r && git -C ../$r remote add origin $base/$r.git
|
||||
git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
|
||||
echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
|
||||
done
|
||||
shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
::endgroup::
|
||||
felhom.eu main at 6ee23a3b8f90
|
||||
felhom-controller at e01eb64b2591
|
||||
app-catalog-felhom.eu at f61800aae945
|
||||
::group::Run set -u
|
||||
set -u
|
||||
mkdir -p documentation/security-watch
|
||||
mode="${MODE:-run}"
|
||||
[ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
|
||||
echo "mode: $mode"
|
||||
case "$mode" in
|
||||
test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
|
||||
dry) extra="--no-mail" ; state=/tmp/state-dry.json
|
||||
cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
|
||||
seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
|
||||
run) extra="" ; state=documentation/security-watch/state.json ;;
|
||||
*) echo "unknown mode $mode"; exit 2 ;;
|
||||
esac
|
||||
python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
|
||||
--controller=../felhom-controller --json=/tmp/watch-results.json $extra
|
||||
shell: bash --noprofile --norc -e -o pipefail {0}
|
||||
env:
|
||||
RESEND_API_KEY: ***
|
||||
GH_ADVISORY_TOKEN:
|
||||
MODE: test-mail
|
||||
::endgroup::
|
||||
mode: test-mail
|
||||
/root/.cache/act/1d095cc34caf5db5/hostexecutor/scripts/security_watch.py:715: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
|
||||
today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
TEST-MAIL RESEND-ACCEPTED id=01a17a5d-b46f-7a8e-b0eb-4e89c01c7354 subject=[Felhom security] TEST — not a real advisory: TEST-program — 1 new advisory
|
||||
Cleaning up container for job watch
|
||||
🏁 Job succeeded
|
||||
Reference in new issue
Block a user