50 lines
3.1 KiB
Markdown
50 lines
3.1 KiB
Markdown
# Picks for the operator — flaws with no fix inside the main version (2026-10-27)
|
|
|
|
No template was changed for any of these. Each pick: the question, CC's pick first, the cost of the other, and what
|
|
happens if nobody decides. Fleet fact for all of them (hub 2026-10-27): **no box runs any of these apps**; the risk is a
|
|
NEW install.
|
|
|
|
## 1. SparkyFitness — two notices, no fix released (GHSA-p8cf-g8rv-gvrq, GHSA-cmmf-53wf-r5gv)
|
|
|
|
What a stranger can do with our template: nothing without an account or a leaked photo URL. p8cf needs a household
|
|
account (it overwrites another member's Withings link); cmmf needs the exact URL of an owner-only photo. A third notice
|
|
(GHSA-v883) does not apply: our template generates `BETTER_AUTH_SECRET` per install.
|
|
|
|
- **A (CC's pick): leave it offered and wait for the upstream fix**, then take it with R-785's big step (0.17 → 1.x).
|
|
Cost: a family that installs it meanwhile carries two medium flaws that need one of its own accounts.
|
|
- **B: hide it from new installs** (`lifecycle: hidden`) until a fixed version is proven. Cost: the app disappears from
|
|
the catalog for an unknown time.
|
|
- **If you do nothing:** A.
|
|
|
|
## 2. Gitea — GHSA-rqhx-647v-wx32: SSRF through a redirect in repository migration (the upstream patch was reverted)
|
|
|
|
What a stranger can do: nothing without an account (sign-up is closed twice in our template). A household account can
|
|
make the box fetch an internal address through „New migration".
|
|
|
|
- **A (CC's pick): leave migrations on**, and judge it again in Gitea's big step (1.27.3 → 28.2.0, which fixes 40 other
|
|
notices). Cost: a signed-in household member can reach the home network through the migration form.
|
|
- **B: turn migrations off** (`GITEA__repository__DISABLE_MIGRATIONS=true`). Cost: the household cannot import a
|
|
repository from GitHub any more.
|
|
- **If you do nothing:** A.
|
|
|
|
## 3. Termix — GHSA-7j7m-85p4-2cpm: a stranger skips the login rate limit with a forged X-Forwarded-For (R-1311)
|
|
|
|
The fix is Termix's big step (2.8 → 2.9.2 → 26.10.5, two hops).
|
|
|
|
- **A (CC's pick): wait for the big step.** Cost: until then, a stranger can guess passwords faster than the limit means.
|
|
- **B: strip the header in the template now** (as docmost and paperless do, R-753). Cost: every visitor then shares the
|
|
tunnel's one address, so a stranger's wrong guesses can lock the household out of the login (the Grimmory shape,
|
|
R-775).
|
|
- **If you do nothing:** A.
|
|
|
|
## 4. The big steps a stranger can use before they are done (Wanderer, Jellyfin, Gitea, Termix)
|
|
|
|
Wanderer's critical notice (GHSA-fprh-3pp9-68m9: any remote ActivityPub server overwrites records, no login, federation
|
|
has no off switch) is the worst open item. Jellyfin (GHSA-hw73, a file read with no login), Gitea (two notices with no
|
|
login) and Termix (above) follow.
|
|
|
|
- **A (CC's pick): hide Wanderer from new installs** (`lifecycle: hidden`) until its big step (v0.21.2) is proven; leave
|
|
the others offered. Cost: Wanderer leaves the catalog for the days its step takes.
|
|
- **B: leave all four offered.** Cost: a new Wanderer install is open to any federated server from its first day.
|
|
- **If you do nothing:** B.
|