26 lines
2.6 KiB
Markdown
26 lines
2.6 KiB
Markdown
# karakeep — triage (pins ghcr.io/karakeep-app/karakeep:0.33.2, ghcr.io/karakeep-app/karakeep-chrome:151.0.7922.47-r1; meilisearch v1.41.0 untouched)
|
|
Template: setup_gate: true + signup_block (signup + tRPC users.create). Browser: our compose uses `karakeep-chrome:151.0.7922.47-r1`
|
|
(BROWSER_WEB_URL=http://karakeep-chrome:9222, internal network only) — EXACTLY the vulnerable image.
|
|
|
|
## Notices
|
|
- GHSA-pp34-2c9r-mchw — REAL. high (two CISA-KEV V8 bugs CVE-2026-85046 / CVE-2026-87491, Chromium started with --no-sandbox).
|
|
Login: any user (anyone who can save a bookmark/RSS feed makes the crawler open the page; a hostile page needs no account of its own).
|
|
Reachable: yes — through content the household saves; strangers cannot submit URLs (gate + signup_block).
|
|
The GHSA lists no patched version, BUT the registry now has `karakeep-chrome:154.0.8037.57-r1` and `156.0.8078.47-r1` (>= 153.0.8010.36 = both fixed).
|
|
v0.34.x source (docker/chrome/Dockerfile) pins GOOGLE_CHROME_VERSION=154.0.8037.57 on debian trixie-slim (Google Chrome on amd64;
|
|
arm64 falls back to Debian's chromium — version not pinned, unsure if >=153 on arm64).
|
|
- release:v0.34.1 — REAL runtime fix: node:24-slim (24.22.1), Oct-2026 Node security release (Brotli OOB write, TLS hostname bypasses).
|
|
- release:v0.34.0 — REAL: Next.js 16.4.1 October security release (#3196) + GHSA-892w-x93w-2fqp (list cycle → infinite loop, any user; not in the watch's list).
|
|
|
|
## Fix
|
|
Smallest: chrome image 154.0.8037.57-r1. TARGET: `ghcr.io/karakeep-app/karakeep:0.34.1` + `ghcr.io/karakeep-app/karakeep-chrome:154.0.8037.57-r1`
|
|
(the pair v0.34.1 ships; 156.0.8078.47-r1 also exists, unsure which karakeep release it is tested with). Tags verified on ghcr (no `v` prefix).
|
|
Same main (0): yes.
|
|
Breaking (0.34.0, 0.34.1 read): auth library next-auth → better-auth (automatic DB migration), EVERY web user signed out once; emails lowercased
|
|
in DB — two accounts differing only by case lock the user out (manual fix before upgrade); new optional AUTH_TRUSTED_ORIGINS; chrome image is now
|
|
full Google Chrome (bigger; 768M limit and the bash healthcheck must be re-measured); crawler driven by patchright.
|
|
Lane: BIG_STEP (forced sign-out + auth data conversion + rebuilt browser image). A chrome-only bump (151 → 154) with app 0.33.2 is
|
|
unsure: not tested upstream as a pair (the GHSA reporter's own replacement image did work with 0.33.2).
|
|
Classifier note: "no fixed version named yet" is stale — the karakeep-chrome registry has 154/156 tags past the KEV fixes; the watch should read
|
|
the chrome image's registry tags against the advisory's fixed Chromium version.
|