22 lines
1.9 KiB
Markdown
22 lines
1.9 KiB
Markdown
# uptime-kuma — triage (pin louislam/uptime-kuma:2.5.5, the normal (root) image, not -rootless)
|
|
Template: setup_gate: true; single-user app (the one account is the admin).
|
|
|
|
## Notices
|
|
- GHSA-98hr-q8q8-5j23 rootless sudo privilege escalation — NOT-A-FINDING: affects only the `-rootless` image variants; we ship `2.5.5`.
|
|
- GHSA-qjxc-h5jf-c7rj SSRF to cloud metadata (range `*`, no patch, "will not fix") — NOT-A-FINDING, decided by hand: the advisory itself says
|
|
it is a deployment-platform issue for cloud IMDS (169.254.169.254); a Felhom box is home hardware with no metadata service, and the only
|
|
account is the admin, who is meant to monitor internal URLs.
|
|
- release:2.5.8 — REAL: GHSA-v2p3-6f5h-6hhf "[Admin Only] RCE" (details not public yet; severity unsure). Login: admin. Reachable: only with the
|
|
household's admin login.
|
|
- release:2.5.7 — REAL runtime fix: Node.js 22.23.4, rejects the leaked eMudhra CA.
|
|
- release:2.5.6 — weak: "chore: Update dependencies" (no CVE named); it is also the release that fixes GHSA-98hr (rootless only). Treat as hygiene.
|
|
|
|
## Fix
|
|
Smallest fixing the real item: 2.5.8. TARGET `louislam/uptime-kuma:2.5.8` (Docker Hub tag exists, no `v`). Same main (2): yes.
|
|
Breaking (3 releases read 2.5.6..2.5.8): 2.5.8 DROPS TLS support for the TCP Port monitor — existing TLS TCP monitors silently become plain TCP
|
|
monitors (a removed option + data conversion). Nothing else.
|
|
Lane: SECURITY_FIX if the operator accepts the TCP-TLS removal as minor (Felhom ships no TCP-TLS monitors by default); strictly by the rule it is a
|
|
removed feature → BIG_STEP. I lean SECURITY_FIX: admin-only RCE + CA distrust, and the removed option "never worked as expected" upstream.
|
|
Classifier note: GHSA-98hr's package name is "Rootless Docker Image only" — the watch should skip it for non-rootless tags; GHSA-qjxc (range `*`,
|
|
no patch, platform issue) should be filtered as permanent won't-fix.
|