48 lines
6.1 KiB
Markdown
48 lines
6.1 KiB
Markdown
# Security notices first seen since 2026-10-29 — the triage (2026-11-02 night)
|
||
|
||
Input: the watch's memory (`documentation/security-watch/state.json`, every notice with `first` ≥ 2026-10-29) plus the fixed
|
||
watch's dry run (`part1/dry-local-after-fix.log`, 13 new lines). Each notice was read in its own text (the release body, the GHSA);
|
||
the versions of the waiters were **read from the image** (`waiters.txt`), never from notes. Fleet: three test boxes report, no
|
||
household. „Lane" = a `security_fix` step (`09` §3 decision 255): same main version, a public id, a proven 9202 walk.
|
||
|
||
## The table of the brief
|
||
|
||
| App (our pin) | Notice | Real? | Reach in our template | Fixed in | What happens |
|
||
|---|---|---|---|---|---|
|
||
| Vaultwarden 1.37.4-alpine | release 1.37.5: GHSA-x9cq-f669-vrr4 (website icons, medium 5.3), GHSA-9pjj-f9g5-3x4c (emergency access, medium 4.3); both still private upstream | **real** | own login; the icon route is public | 1.37.5-alpine | **Lane.** Upgrade notes: „invalid values now stop startup" — our template sets none of the named options (grep) |
|
||
| Uptime Kuma 2.5.7 | GHSA-86ch-2247-gr56 (unauth RSS cache poisoning by Host header, medium, `>= 2.1.0, <= 2.5.8`); GHSA-v2p3-6f5h-6hhf (admin-only RCE via Apprise, high, fixed 2.5.8) | **real** | RSS only if a public status page exists; v2p3 needs the admin | 2.5.9 | **Lane**, and it crosses 2.5.8, which the 10-27 batch refused: it drops TLS on the TCP-port monitor. Upstream: „never worked as expected … all existing monitors will become normal TCP monitors". Decided by CC unattended (operator may reverse): the fix outweighs it, no box runs Kuma, and no data is touched. Named on the list |
|
||
| n8n 2.44.7 | 12 GHSAs first seen 10-29 | **real** | own login; two reach before login (`GHSA-426f` OAuth callback, `GHSA-mx4r` Asana trigger) | nine in 2.45.5 / 2.46.1; **three only in 3.0.1** (`GHSA-9p7v` high, `GHSA-mx4r`, `GHSA-2x68`) | **Lane to 2.46.4** for the nine; the three go to a big step (a new main version), row filed. `GHSA-365g` names no fix |
|
||
| PrivateBin 2.1.0 | GHSA-hw9p-r7fq-8mvr (comment replay, medium), GHSA-c4gc-8mcm-hh65 (2.1.0's XSS fix is ineffective, medium) | **real** | public by design | 2.1.1 — **no release and no image exist** (PrivateBin's newest release is 2.1.0; `privatebin/pdo` has no 2.1.1 tag) | **No step tonight.** Row filed; the watch keeps it open |
|
||
| Traefik v3.7.16 (box) | `release:traefik@v3.7.17` | **REAL — not the false alarm the brief expected.** The word-only line („Point security announcements …") hid a real id in the same notes: **GHSA-xv5x-242w-7hf7, high, published 2026-11-02 09:15 UTC**: an unauthenticated client holds a backend transport per connection (v3.7.14–v3.7.16) until memory runs out, NTLM backend or not | every box, in front of everything | v3.7.17 | **Pin committed**, controller `c4b6844`; proven on 9202 on the test image. **First on the release list** |
|
||
|
||
## What else was first seen since Thursday
|
||
|
||
| App (our pin) | Notice | Real? | What happens |
|
||
|---|---|---|---|
|
||
| Gitea 28.2.0 (catalog) | 21 GHSAs fixed in 28.3.0 (high: `GHSA-8p3x` OAuth2 auto-link account takeover, `GHSA-jh8p`, `GHSA-37xv`, `GHSA-8g99`, `GHSA-32h8`, `GHSA-9v6p`, `GHSA-6h2f`) | **real** | **Lane.** `GHSA-x4q3` is the runner's, not ours (now not listed, R-1310) |
|
||
| Gitea 1.26.2 on **DooPlex** | 19 of the same | **real, on the host that holds our code and registry** | Not ours to touch: homelab list, filed; first on that list |
|
||
| Vaultwarden 1.37.4, Uptime Kuma 2.5.6 on **DooPlex** | as above | real | Homelab list |
|
||
| FileBrowser 1.5.8-stable (box) | GHSA-892f-9h5p-mfc8 (low): `/api/settings` shows secrets to an ADMIN's token | real, admin only | R-1305's list; the fix is on 2.1.0-stable (a new main version) |
|
||
| cloudflared 2026.10.4 (box) | VULN-183456 (2026.10.5, chi bump), VULN-184686 (2026.10.6, go-jose bump) | real dependency fixes, no public text on reach | Row filed: raise it on a controller release after a tunnel proof (the newest is 2026.10.7). Not pinned tonight: the tunnel is a box's only door, and 9202 has none to prove it on |
|
||
| Grafana 13.2.4 | release 13.2.5 names four CVEs (first seen 10-28) | real | **Lane.** |
|
||
| Mealie v3.29.0 | v3.30.0: „update dependency pillow to v13 [security]" | a dependency fix, no id | Normal step (bench + box, drill only). v3.30.0 also removes `OPENAI_CUSTOM_PROMPT_DIR` (imported automatically; our template does not set it). Row filed |
|
||
| Termix 26.10.5 | v26.10.6: „body-parser is updated to 2.4.0 for a security fix" | a dependency fix, no id | Normal step, drill only. Row filed |
|
||
| Meilisearch v1.41.0 (karakeep), v1.36.0 (wanderer) | v1.55.1 / v1.56.1: „important security fixes" (long filters, rustls) | real, but the search engine sits on the app's private network | Not reachable from outside. A jump of 15–20 versions needs its dump migration: a big step. Row filed |
|
||
| Actual 26.9.0 | GHSA-p7p2-pm6f-rg6x (Electron fuse, desktop app) | `NOT-A-FINDING`: the desktop client, we run the server | Fixed in 26.11.0 anyway, the waiter's step below |
|
||
| Paperless 3.3.4 on DooPlex | v3.4.0 „bump some frontend deps for security fixes" | real | Homelab list |
|
||
|
||
## The six HTTP2Shell waiters (CVE-2026-111497) — read from the image
|
||
|
||
| App | Pin | Newest same shape | Runtime in the newest | Fixed release? | What happens |
|
||
|---|---|---|---|---|---|
|
||
| ActualBudget (R-1336) | 26.9.0 (Node 24.20.0) | 26.11.0 | **Node 24.22.1** | **YES**, same main | **Lane** |
|
||
| cal.com (R-1329, R-1325) | v6.2.0 (Node 20.20.0) | v6.2.0 | Node 20.20.0 | no | Waits |
|
||
| Calibre-Web (R-1337) | v4.0.8 (Python Brotli 1.2.0) | v4.0.8 | same | no | Waits |
|
||
| Paperless (R-1331) | 2.20.15 (Python Brotli 1.1.0) | 3.4.1 | **clean** (3.4.0 and 3.4.1; 3.3.4 still bad) | **YES, a new main version** | Big step: bench + 9202 + undo, drill only |
|
||
| RomM (R-1330) | 5.4.1 (Node 24.18.1) | 5.4.1 | same | no | Waits (D61) |
|
||
| SparkyFitness | v0.17.3 (Node 24.18.0) | v1.11.0 | **Node 24.22.1** (v1.10.0 and v1.11.0; v1.9.0 still bad) | **YES, a new main version** | Big step; R-784 (licence) and R-785 stand before it |
|
||
|
||
## The walks
|
||
|
||
See `walks/<app>/walk.txt` and `box-verdict-<app>.json`; the result of each is in the close-out below.
|